Wei ChenandGreg Kroah-Hartman da4e9eff0f media: vcodec: Fix potential array out-of-bounds in encoder queue_setup ...

commit e7f2e65699 upstream.

variable *nplanes is provided by user via system call argument. The
possible value of q_data->fmt->num_planes is 1-3, while the value
of *nplanes can be 1-8. The array access by index i can cause array
out-of-bounds.

Fix this bug by checking *nplanes against the array size.

Fixes: 4e855a6efa ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-08-30 16:23:16 +02:00

..

cec

media: cec: i2c: ch7322: also select REGMAP

2023-07-27 08:44:08 +02:00

common

…

dvb-core

media: dvb-core: Fix use-after-free due to race at dvb_register_device()

2023-06-21 15:45:41 +02:00

dvb-frontends

media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table

2023-06-09 10:30:11 +02:00

firewire

…

i2c

media: max9286: Free control handler

2023-05-17 11:47:41 +02:00

mc

…

mmc

…

pci

media: netup_unidvb: fix irq init by register it at the end of probe

2023-06-09 10:30:10 +02:00

platform

media: vcodec: Fix potential array out-of-bounds in encoder queue_setup

2023-08-30 16:23:16 +02:00

radio

media: radio-shark: Add endpoint checks

2023-05-30 12:57:57 +01:00

rc

media: rc: gpio-ir-recv: Fix support for wake-up

2023-05-17 11:47:44 +02:00

spi

…

test-drivers

media: vimc: Fix wrong function called when vimc_init() fails

2023-01-14 10:15:32 +01:00

tuners

…

usb

media: usb: siano: Fix warning due to null work_func_t function pointer

2023-07-27 08:44:03 +02:00

v4l2-core

media: videobuf-dma-contig: use dma_mmap_coherent

2023-01-14 10:15:30 +01:00

Kconfig

…

Makefile

…