From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
To: Hans Verkuil <hverkuil@xs4all.nl>,
Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
"Gustavo A. R. Silva" <gustavoars@kernel.org>,
linux-hardening@vger.kernel.org
Subject: [PATCH][next] media: usb: pwc-uncompress: Use flex array destination for memcpy()
Date: Wed, 7 Sep 2022 19:55:44 +0100 [thread overview]
Message-ID: <YxjpMMUb3WP5Rbu7@work> (raw)
In preparation for FORTIFY_SOURCE performing run-time destination buffer
bounds checking for memcpy(), specify the destination output buffer
explicitly, instead of asking memcpy() to write past the end of what looked
like a fixed-size object.
Notice that raw_frame is a pointer to a structure that contains
flexible-array member rawframe[]:
drivers/media/usb/pwc/pwc.h:
190 struct pwc_raw_frame {
191 __le16 type; /* type of the webcam */
192 __le16 vbandlength; /* Size of 4 lines compressed (used by the
193 decompressor) */
194 __u8 cmd[4]; /* the four byte of the command (in case of
195 nala, only the first 3 bytes is filled) */
196 __u8 rawframe[]; /* frame_size = H / 4 * vbandlength */
197 } __packed;
Link: https://github.com/KSPP/linux/issues/200
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
drivers/media/usb/pwc/pwc-uncompress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/pwc/pwc-uncompress.c b/drivers/media/usb/pwc/pwc-uncompress.c
index faf44cdeb268..cf2591a9675c 100644
--- a/drivers/media/usb/pwc/pwc-uncompress.c
+++ b/drivers/media/usb/pwc/pwc-uncompress.c
@@ -39,7 +39,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf)
* first 3 bytes is filled (Nala case). We can
* determine this using the type of the webcam */
memcpy(raw_frame->cmd, pdev->cmd_buf, 4);
- memcpy(raw_frame+1, yuv, pdev->frame_size);
+ memcpy(raw_frame->rawframe, yuv, pdev->frame_size);
vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0,
struct_size(raw_frame, rawframe, pdev->frame_size));
return 0;
--
2.34.1
next reply other threads:[~2022-09-07 18:56 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-07 18:55 Gustavo A. R. Silva [this message]
2022-09-07 22:25 ` [PATCH][next] media: usb: pwc-uncompress: Use flex array destination for memcpy() Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YxjpMMUb3WP5Rbu7@work \
--to=gustavoars@kernel.org \
--cc=hverkuil@xs4all.nl \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.