Skip to contentSkip to conversation

media: usb: pwc-uncompress: Use struct_size() helper in pwc_decompress()

PATCH In review Gustavo A. R. Silva 2 participants 2 messages Jan 20, 2022

Subsystems (2)
Media (V4L/DVB) Pwc webcam driver
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 media: usb: pwc-uncompress: Use struct_size() helper in pwc_decompress()

Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worst scenario, could lead to heap overflows.

Also, address the following sparse warnings:
drivers/media/usb/pwc/pwc-uncompress.c:44:44: warning: using sizeof on a flexible structure

Link https://github.com/KSPP/linux/issues/174
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/media/usb/pwc/pwc-uncompress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/pwc/pwc-uncompress.c +1 -1
index 68bc3829c6b3..faf44cdeb268 100644
@@ -41,7 +41,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf)
 		memcpy(raw_frame->cmd, pdev->cmd_buf, 4);
 		memcpy(raw_frame+1, yuv, pdev->frame_size);
 		vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0,
-			pdev->frame_size + sizeof(struct pwc_raw_frame));
+			struct_size(raw_frame, rawframe, pdev->frame_size));
 		return 0;
 	}
Signature · 1 line
2.27.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 9 lines · Gustavo A. R. Silva

Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worst scenario, could lead to heap overflows.

Also, address the following sparse warnings:
drivers/media/usb/pwc/pwc-uncompress.c:44:44: warning: using sizeof on a flexible structure

Link https://github.com/KSPP/linux/issues/174
Signed-off-by Gustavo A. R. Silva <[email protected]>

Yup, happy to see these getting changed.

Reviewed-by Kees Cook <[email protected]>
Quoted 20 lines
---
 drivers/media/usb/pwc/pwc-uncompress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/pwc/pwc-uncompress.c +1 -1
index 68bc3829c6b3..faf44cdeb268 100644
@@ -41,7 +41,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf)
 		memcpy(raw_frame->cmd, pdev->cmd_buf, 4);
 		memcpy(raw_frame+1, yuv, pdev->frame_size);
 		vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0,
-			pdev->frame_size + sizeof(struct pwc_raw_frame));
+			struct_size(raw_frame, rawframe, pdev->frame_size));
 		return 0;
 	}
Signature · 1 line
2.27.0
Signature · 1 line
Kees Cook