Closed GustavoARSilva closed 1 year ago
Yeah, it should be possible to just change "raw_frame+1" to "raw_frame->rawframe".
Yeah, it should be possible to just change "raw_frame+1" to "raw_frame->rawframe".
Yep:
diff --git a/drivers/media/usb/pwc/pwc-uncompress.c b/drivers/media/usb/pwc/pwc-uncompress.c
index faf44cdeb2688..cf2591a9675cf 100644
--- a/[drivers/media/usb/pwc/pwc-uncompress.c](https://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux.git/tree/drivers/media/usb/pwc/pwc-uncompress.c?h=testing/6.0-rc2-kspp-misc&id=61b2005335d446d9169be9405696be6e7507ebd3)
+++ b/[drivers/media/usb/pwc/pwc-uncompress.c](https://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux.git/tree/drivers/media/usb/pwc/pwc-uncompress.c?h=testing/6.0-rc2-kspp-misc&id=e306cf23b09c2d126d09d06497c6a1c680799834)
@@ -39,7 +39,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf)
* first 3 bytes is filled (Nala case). We can
* determine this using the type of the webcam */
memcpy(raw_frame->cmd, pdev->cmd_buf, 4);
- memcpy(raw_frame+1, yuv, pdev->frame_size);
+ memcpy(raw_frame->rawframe, yuv, pdev->frame_size);
vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0,
struct_size(raw_frame, rawframe, pdev->frame_size));
return 0;
I just sent out a patch for this: https://lore.kernel.org/linux-hardening/YxjpMMUb3WP5Rbu7@work/
Hi guys, is there a similar problem in drivers/infiniband/ulp/srpt/ib_srpt.c? It looks like srpt_build_cmd_rsp also use flexible-array member as destination in memcpy(). https://elixir.bootlin.com/linux/v6.0-rc4/source/drivers/infiniband/ulp/srpt/ib_srpt.c#L1424
Hi guys, is there a similar problem in drivers/infiniband/ulp/srpt/ib_srpt.c? It looks like srpt_build_cmd_rsp also use flexible-array member as destination in memcpy(). https://elixir.bootlin.com/linux/v6.0-rc4/source/drivers/infiniband/ulp/srpt/ib_srpt.c#L1424
Hi!
Yep; that seems to be the same problem. Wanna send a patch? :)
I can open an issue for that so you can include the link to it.
raw_frame is a pointer to a flexible structure (a structure that contains a trailing flexible-array member). Use the flexible-array member as destination in memcpy(), explicitly.
Caught with the following Cocci script: