Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: video/hdmi: handle short reads of hdmi info frame.

Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
the size checking done later in hdmi_infoframe_unpack(). A better
value is the amount of data read into buffer.

Fixes: 480b8b3e42c3 ("video/hdmi: Pass buffer size to infoframe unpack functions")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

authored by

Tom Rix and committed by
Mauro Carvalho Chehab
4a92fc6e 4a2e0a80

+3 -3
+1 -1
drivers/media/i2c/adv7511-v4l2.c
··· 522 522 buffer[3] = 0; 523 523 buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); 524 524 525 - if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { 525 + if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) { 526 526 v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); 527 527 return; 528 528 }
+1 -1
drivers/media/i2c/adv7604.c
··· 2484 2484 buffer[i + 3] = infoframe_read(sd, 2485 2485 adv76xx_cri[index].payload_addr + i); 2486 2486 2487 - if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) { 2487 + if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) { 2488 2488 v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, 2489 2489 adv76xx_cri[index].desc); 2490 2490 return -ENOENT;
+1 -1
drivers/media/i2c/adv7842.c
··· 2583 2583 for (i = 0; i < len; i++) 2584 2584 buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i); 2585 2585 2586 - if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { 2586 + if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) { 2587 2587 v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); 2588 2588 return; 2589 2589 }