media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
authorBenoit Sevens <bsevens@google.com>
Thu, 7 Nov 2024 14:22:02 +0000 (14:22 +0000)
committerHans Verkuil <hverkuil@xs4all.nl>
Sat, 9 Nov 2024 12:17:42 +0000 (13:17 +0100)
commitecf2b43018da9579842c774b7f35dbe11b5c38dd
tree5ef530c44d6791131c1b99c7588e227acdda41cc
parent702a47ce6dde72f6e247b3c3c00a0fc521f9b1c6
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.

Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Benoit Sevens <bsevens@google.com>
Cc: stable@vger.kernel.org
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
drivers/media/usb/uvc/uvc_driver.c