On Thu Apr 9 15:49:45 2026 +0200, Greg Kroah-Hartman wrote:
> The FIFO_BYTENBR_FIELD register field is 4 bits wide, giving a length
> of 0..15, but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply.
> A faulty or malicious DiSEqC slave (or i2c bus glitch) reporting more
> than 4 bytes will the array and clobber the stack.
>
> The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
> count against sizeof(reply->msg) before the read loop, so do the same
> thing in this driver.
>
> Fixes: e415c689a884 ("V4L/DVB (11579): Initial go at TT S2-1600")
> Cc: [email protected]
> Assisted-by: gregkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/dvb-frontends/stv090x.c | 2 ++
1 file changed, 2 insertions(+)
---
diff --git a/drivers/media/dvb-frontends/stv090x.c
b/drivers/media/dvb-frontends/stv090x.c
index 932bbed5497a..63be9ee104ab 100644
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -3902,6 +3902,8 @@ static int stv090x_recv_slave_reply(struct dvb_frontend
*fe, struct dvb_diseqc_s
if (rx_end) {
reply->msg_len = STV090x_GETFIELD_Px(reg, FIFO_BYTENBR_FIELD);
+ if (reply->msg_len > sizeof(reply->msg))
+ reply->msg_len = sizeof(reply->msg);
for (i = 0; i < reply->msg_len; i++)
reply->msg[i] = STV090x_READ_DEMOD(state, DISRXDATA);
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
