media: stv06xx: add missing descriptor sanity checks
authorJohan Hovold <johan@kernel.org>
Fri, 3 Jan 2020 16:35:10 +0000 (17:35 +0100)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 12 Mar 2020 16:26:42 +0000 (17:26 +0100)
commit485b06aadb933190f4bc44e006076bc27a23f205
tree73f76b0f717ca189f5e42de6ebfa51339f4228c3
parent998912346c0da53a6dbb71fab3a138586b596b30
media: stv06xx: add missing descriptor sanity checks

Make sure to check that we have two alternate settings and at least one
endpoint before accessing the second altsetting structure and
dereferencing the endpoint arrays.

This specifically avoids dereferencing NULL-pointers or corrupting
memory when a device does not have the expected descriptors.

Note that the sanity checks in stv06xx_start() and pb0100_start() are
not redundant as the driver is mixing looking up altsettings by index
and by number, which may not coincide.

Fixes: 8668d504d72c ("V4L/DVB (12082): gspca_stv06xx: Add support for st6422 bridge and sensor")
Fixes: c0b33bdc5b8d ("[media] gspca-stv06xx: support bandwidth changing")
Cc: stable <stable@vger.kernel.org> # 2.6.31
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/usb/gspca/stv06xx/stv06xx.c
drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c