From: Kees Cook <keescook@chromium.org>
To: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Hans Verkuil <hverkuil@xs4all.nl>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-hardening@vger.kernel.org
Subject: Re: [PATCH][next] media: usb: pwc-uncompress: Use flex array destination for memcpy()
Date: Wed, 7 Sep 2022 15:25:40 -0700 [thread overview]
Message-ID: <202209071525.AFFA11872@keescook> (raw)
In-Reply-To: <YxjpMMUb3WP5Rbu7@work>
On Wed, Sep 07, 2022 at 07:55:44PM +0100, Gustavo A. R. Silva wrote:
> In preparation for FORTIFY_SOURCE performing run-time destination buffer
> bounds checking for memcpy(), specify the destination output buffer
> explicitly, instead of asking memcpy() to write past the end of what looked
> like a fixed-size object.
>
> Notice that raw_frame is a pointer to a structure that contains
> flexible-array member rawframe[]:
>
> drivers/media/usb/pwc/pwc.h:
> 190 struct pwc_raw_frame {
> 191 __le16 type; /* type of the webcam */
> 192 __le16 vbandlength; /* Size of 4 lines compressed (used by the
> 193 decompressor) */
> 194 __u8 cmd[4]; /* the four byte of the command (in case of
> 195 nala, only the first 3 bytes is filled) */
> 196 __u8 rawframe[]; /* frame_size = H / 4 * vbandlength */
> 197 } __packed;
>
> Link: https://github.com/KSPP/linux/issues/200
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks! Yeah, this looks very similar to other transformations like
this. And this one even had the flex array already! :)
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
prev parent reply other threads:[~2022-09-07 22:25 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-07 18:55 [PATCH][next] media: usb: pwc-uncompress: Use flex array destination for memcpy() Gustavo A. R. Silva
2022-09-07 22:25 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202209071525.AFFA11872@keescook \
--to=keescook@chromium.org \
--cc=gustavoars@kernel.org \
--cc=hverkuil@xs4all.nl \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.