On Thu Apr 9 15:49:46 2026 +0200, Greg Kroah-Hartman wrote:
> The FIFO_BYTENBR field is 4 bits (mask 0x0f), giving a length of 0..15
> but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply. A faulty or
> malicious device reporting more than 4 bytes will the array and clobber
> the stack.
>
> The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
> count against sizeof(reply->msg) before the read loop, so do the same
> thing in this driver.
>
> Fixes: 99277b3824e4 ("V4L/DVB (10803): Add core code for ST STV0900 dual
> demodulator.")
> Cc: [email protected]
> Assisted-by: gregkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/dvb-frontends/stv0900_core.c | 2 ++
1 file changed, 2 insertions(+)
---
diff --git a/drivers/media/dvb-frontends/stv0900_core.c
b/drivers/media/dvb-frontends/stv0900_core.c
index d15c55de2723..0ca6b6d81273 100644
--- a/drivers/media/dvb-frontends/stv0900_core.c
+++ b/drivers/media/dvb-frontends/stv0900_core.c
@@ -1773,6 +1773,8 @@ static int stv0900_recv_slave_reply(struct dvb_frontend
*fe,
if (stv0900_get_bits(intp, RX_END)) {
reply->msg_len = stv0900_get_bits(intp, FIFO_BYTENBR);
+ if (reply->msg_len > sizeof(reply->msg))
+ reply->msg_len = sizeof(reply->msg);
for (i = 0; i < reply->msg_len; i++)
reply->msg[i] = stv0900_read_reg(intp, DISRXDATA);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
