mirror of
https://github.com/torvalds/linux.git
synced 2026-10-16 12:50:02 +02:00
627a121c15
vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide
dev->width / dev->norm but only refuse the change when the *video* queue
(dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry:
cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm,
the VBI videobuf2 plane is sized from dev->width / dev->norm in
vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then
recomputes the destination offset from the *live* dev->width and the
latched lines_per_field on every URB completion:
offset = lines_completed * (dev->width << 1) + ...;
if (dma_q->current_field == 2)
offset += dev->width * 2 * dma_q->lines_per_field;
memcpy(plane + offset, p_buffer, lencopy);
Because the VBI node shares video_ioctl_ops with the video node, an
application can size a small VBI plane (REQBUFS/QBUF with a small width,
or with the NTSC standard), then enlarge dev->width (or switch dev->norm
to PAL) through the video node while the VBI stream is running -- the
change is allowed because only dev->vidq is checked -- and let the device
deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the
offset with the larger geometry and memcpy()s past the end of the smaller
plane that was already allocated, a heap out-of-bounds write whose offset
is attacker-chosen and whose contents come from the device. The
per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the
copy against the latched lines_per_field, not the plane's real capacity,
and vb2 does not re-run buf_prepare() for an already prepared buffer.
Refuse the format/standard change when the VBI queue is busy as well, so
the geometry cannot change underneath an allocated VBI buffer.
Fixes:
|
||
|---|---|---|
| .. | ||
| cx231xx-417.c | ||
| cx231xx-audio.c | ||
| cx231xx-avcore.c | ||
| cx231xx-cards.c | ||
| cx231xx-conf-reg.h | ||
| cx231xx-core.c | ||
| cx231xx-dif.h | ||
| cx231xx-dvb.c | ||
| cx231xx-i2c.c | ||
| cx231xx-input.c | ||
| cx231xx-pcb-cfg.c | ||
| cx231xx-pcb-cfg.h | ||
| cx231xx-reg.h | ||
| cx231xx-vbi.c | ||
| cx231xx-vbi.h | ||
| cx231xx-video.c | ||
| cx231xx.h | ||
| Kconfig | ||
| Makefile | ||