The while loop in pluto_dma_end() scans the DMA buffer for MPEG-TS sync bytes (0x47) at 188-byte intervals. However, it does not check the buffer boundary. If the buffer contains 0x47 at every 188-byte offset, the loop index will exceed the buffer size, causing an out-of-bounds read.
Add a check to ensure the index stays within TS_DMA_BYTES.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c7cadb3a02b5 ("[PATCH] dvb: add Pluto2 driver") Signed-off-by: Dmitriy Chumachenko Dmitry.Chumachenko@cyberprotect.ru --- drivers/media/pci/pluto2/pluto2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/pluto2/pluto2.c b/drivers/media/pci/pluto2/pluto2.c index 6ac9b9bd7435..fd7f8d8b85a8 100644 --- a/drivers/media/pci/pluto2/pluto2.c +++ b/drivers/media/pci/pluto2/pluto2.c @@ -291,7 +291,7 @@ static void pluto_dma_end(struct pluto *pluto, unsigned int nbpackets) */ if ((nbpackets == 0) || (nbpackets > TS_DMA_PACKETS)) { unsigned int i = 0; - while (pluto->dma_buf[i] == 0x47) + while (i < TS_DMA_BYTES && pluto->dma_buf[i] == 0x47) i += 188; nbpackets = i / 188; if (i == 0) {