linux/drivers/media/usb/gspca
Dan Carpenter aef89c0b24 media: gspca: Add bounds checking to firmware parser
This sd_init() function reads the firmware.  The firmware data holds a
series of records and the function reads each record and sends the data
to the device.  The request_ihex_firmware() function
calls ihex_validate_fw() which ensures that the total length of all the
records won't read out of bounds of the fw->data[].

However, a potential issue is if there is a single very large
record (larger than PAGE_SIZE) and that would result in memory
corruption.  Generally we trust the firmware, but it's always better to
double check.

Fixes: 49b61ec9b5 ("[media] gspca: Add new vicam subdriver")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-17 10:35:15 +02:00
..
gl860
m5602
stv06xx
autogain_functions.c
benq.c
conex.c
cpia1.c
dtcs033.c
etoms.c
finepix.c
gspca.c
gspca.h
jeilinj.c
jl2005bcd.c
jpeg.h
Kconfig
kinect.c
konica.c
Makefile
mars.c
mr97310a.c
nw80x.c
ov519.c
ov534.c
ov534_9.c
pac207.c
pac7302.c
pac7311.c
pac_common.h
se401.c
se401.h
sn9c20x.c
sn9c2028.c
sn9c2028.h
sonixb.c
sonixj.c
spca500.c
spca501.c
spca505.c
spca506.c
spca508.c
spca561.c
spca1528.c
sq905.c
sq905c.c
sq930x.c
stk014.c
stk1135.c
stk1135.h
stv0680.c
sunplus.c
t613.c
topro.c
touptek.c
tv8532.c
vc032x.c
vicam.c
w996Xcf.c
xirlink_cit.c
zc3xx-reg.h
zc3xx.c