Ariel Silver 145e50c2c7 media: dvb-net: fix OOB access in ULE extension header tables ...

commit 24d8771272 upstream.

The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables
in handle_one_ule_extension() are declared with 255 elements (valid
indices 0-254), but the index htype is derived from network-controlled
data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When
htype equals 255, an out-of-bounds read occurs on the function pointer
table, and the OOB value may be called as a function pointer.

Add a bounds check on htype against the array size before either table
is accessed. Out-of-range values now cause the SNDU to be discarded.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Ariel Silver <arielsilver77@gmail.com>
Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-03-25 11:08:35 +01:00

..

dmxdev.c

…

dvb_ca_en50221.c

…

dvb_demux.c

…

dvb_frontend.c

…

dvb_net.c

media: dvb-net: fix OOB access in ULE extension header tables

2026-03-25 11:08:35 +01:00

dvb_ringbuffer.c

…

dvb_vb2.c

…

dvbdev.c

…

Kconfig

…

Makefile

…