• Johan Hovold's avatar
    media: stv06xx: add missing descriptor sanity checks · 485b06aa
    Johan Hovold authored
    Make sure to check that we have two alternate settings and at least one
    endpoint before accessing the second altsetting structure and
    dereferencing the endpoint arrays.
    
    This specifically avoids dereferencing NULL-pointers or corrupting
    memory when a device does not have the expected descriptors.
    
    Note that the sanity checks in stv06xx_start() and pb0100_start() are
    not redundant as the driver is mixing looking up altsettings by index
    and by number, which may not coincide.
    
    Fixes: 8668d504 ("V4L/DVB (12082): gspca_stv06xx: Add support for st6422 bridge and sensor")
    Fixes: c0b33bdc ("[media] gspca-stv06xx: support bandwidth changing")
    Cc: stable <stable@vger.kernel.org>     # 2.6.31
    Cc: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
    Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
    485b06aa
stv06xx_pb0100.c 12 KB