Zhang Shurong b97719a669 media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer ... In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd76 ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>		2023-07-19 12:57:50 +02:00
..
af9015.c
af9015.h
af9035.c	media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer	2023-07-19 12:57:48 +02:00
af9035.h
anysee.c	media: anysee: fix null-ptr-deref in anysee_master_xfer	2023-07-19 12:57:50 +02:00
anysee.h
au6610.c
au6610.h
az6007.c	media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()	2023-07-19 12:57:50 +02:00
ce6230.c	media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()	2023-05-14 06:30:01 +01:00
ce6230.h
dvb_usb_common.h
dvb_usb_core.c
dvb_usb_urb.c
dvb_usb.h
dvbsky.c
ec168.c
ec168.h
gl861.c	media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer	2023-07-19 12:57:50 +02:00
Kconfig
lmedm04.c
lmedm04.h
Makefile
mxl111sf-demod.c
mxl111sf-demod.h
mxl111sf-gpio.c
mxl111sf-gpio.h
mxl111sf-i2c.c
mxl111sf-i2c.h
mxl111sf-phy.c
mxl111sf-phy.h
mxl111sf-reg.h
mxl111sf-tuner.c
mxl111sf-tuner.h
mxl111sf.c
mxl111sf.h
rtl28xxu.c	media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer	2023-05-14 06:30:03 +01:00
rtl28xxu.h
usb_urb.c
zd1301.c