The while loop in pluto_dma_end() scans the DMA buffer for MPEG-TS sync
bytes (0x47) at 188-byte intervals. However, it does not check the buffer
boundary. If the buffer contains 0x47 at every 188-byte offset, the loop
index will exceed the buffer size, causing an out-of-bounds read.
Add a check to ensure the index stays within TS_DMA_BYTES.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c7cadb3a02b5 ("[PATCH] dvb: add Pluto2 driver")
Signed-off-by: Dmitriy Chumachenko <[email protected]>
---
drivers/media/pci/pluto2/pluto2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/pluto2/pluto2.c
b/drivers/media/pci/pluto2/pluto2.c
index 6ac9b9bd7435..fd7f8d8b85a8 100644
--- a/drivers/media/pci/pluto2/pluto2.c
+++ b/drivers/media/pci/pluto2/pluto2.c
@@ -291,7 +291,7 @@ static void pluto_dma_end(struct pluto *pluto, unsigned int
nbpackets)
*/
if ((nbpackets == 0) || (nbpackets > TS_DMA_PACKETS)) {
unsigned int i = 0;
- while (pluto->dma_buf[i] == 0x47)
+ while (i < TS_DMA_BYTES && pluto->dma_buf[i] == 0x47)
i += 188;
nbpackets = i / 188;
if (i == 0) {
--
2.49.0
