Zhang Shurong cd6764cf45 media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer ... [ Upstream commit aa4a447b81 ] In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd76 ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/tencent_3623572106754AC2F266B316798B0F6CCA05@qq.com Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-06-09 10:32:23 +02:00
..
af9015.c
af9015.h
af9035.c
af9035.h
anysee.c
anysee.h
au6610.c
au6610.h
az6007.c
ce6230.c
ce6230.h
dvb_usb_common.h
dvb_usb_core.c
dvb_usb_urb.c
dvb_usb.h
dvbsky.c
ec168.c
ec168.h
gl861.c
Kconfig
lmedm04.c
lmedm04.h
Makefile
mxl111sf-demod.c
mxl111sf-demod.h
mxl111sf-gpio.c
mxl111sf-gpio.h
mxl111sf-i2c.c
mxl111sf-i2c.h
mxl111sf-phy.c
mxl111sf-phy.h
mxl111sf-reg.h
mxl111sf-tuner.c
mxl111sf-tuner.h
mxl111sf.c
mxl111sf.h
rtl28xxu.c	media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer	2023-06-09 10:32:23 +02:00
rtl28xxu.h
usb_urb.c
zd1301.c