iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/media
History
Wei Chen fe04122b93 media: vcodec: Fix potential array out-of-bounds in encoder queue_setup 
commit e7f2e65699e2290fd547ec12a17008764e5d9620 upstream.

variable *nplanes is provided by user via system call argument. The
possible value of q_data->fmt->num_planes is 1-3, while the value
of *nplanes can be 1-8. The array access by index i can cause array
out-of-bounds.

Fix this bug by checking *nplanes against the array size.

Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-30 16:11:09 +02:00
..
cec
media: cec: i2c: ch7322: also select REGMAP
2023-07-19 16:22:00 +02:00
common
media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
2022-12-07 11:25:40 -08:00
dvb-core
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
2023-06-09 10:34:13 +02:00
dvb-frontends
media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
2023-06-09 10:34:12 +02:00
firewire
media: Makefiles: remove extra spaces
2022-03-12 16:59:52 +01:00
i2c
media: hi846: fix usage of pm_runtime_get_if_in_use()
2023-07-19 16:21:51 +02:00
mc
media: mc: Get media_device directly from pad
2023-03-10 09:33:42 +01:00
mmc
media: media/*/Kconfig: sort entries
2022-03-18 05:58:35 +01:00
pci
media: netup_unidvb: fix irq init by register it at the end of probe
2023-06-09 10:34:12 +02:00
platform
media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
2023-08-30 16:11:09 +02:00
radio
media: radio-shark: Add endpoint checks
2023-05-30 14:03:20 +01:00
rc
media: rc: gpio-ir-recv: Fix support for wake-up
2023-05-11 23:03:15 +09:00
spi
media updates for v5.18-rc1
2022-03-23 14:51:35 -07:00
test-drivers
media: vimc: Fix wrong function called when vimc_init() fails
2022-12-31 13:32:16 +01:00
tuners
media fixes for v6.1-rc2
2022-10-22 15:30:15 -07:00
usb
media: usb: siano: Fix warning due to null work_func_t function pointer
2023-07-19 16:21:50 +02:00
v4l2-core
media: v4l: async: Return async sub-devices to subnotifier list
2023-05-11 23:03:15 +09:00
Kconfig
media: remove reference to CONFIG_EMBEDDED in MEDIA_SUPPORT_FILTER
2022-09-08 18:19:29 +02:00
Makefile
media: Makefiles: remove extra spaces
2022-03-12 16:59:52 +01:00