On Sat Feb 21 15:26:00 2026 +0100, Ariel Silver wrote:
> The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables
> in handle_one_ule_extension() are declared with 255 elements (valid
> indices 0-254), but the index htype is derived from network-controlled
> data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When
> htype equals 255, an out-of-bounds read occurs on the function pointer
> table, and the OOB value may be called as a function pointer.
>
> Add a bounds check on htype against the array size before either table
> is accessed. Out-of-range values now cause the SNDU to be discarded.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Ariel Silver <[email protected]>
> Signed-off-by: Ariel Silver <[email protected]>
> Cc: [email protected]
> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Patch committed.
Thanks,
Mauro Carvalho Chehab
drivers/media/dvb-core/dvb_net.c | 3 +++
1 file changed, 3 insertions(+)
---
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index 8bb8dd34c223..a2159b2bc176 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -228,6 +228,9 @@ static int handle_one_ule_extension( struct dvb_net_priv *p
)
unsigned char hlen = (p->ule_sndu_type & 0x0700) >> 8;
unsigned char htype = p->ule_sndu_type & 0x00FF;
+ if (htype >= ARRAY_SIZE(ule_mandatory_ext_handlers))
+ return -1;
+
/* Discriminate mandatory and optional extension headers. */
if (hlen == 0) {
/* Mandatory extension header */
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
