Zhang Shurong abb6fd93e0 media: af9005: Fix null-ptr-deref in af9005_i2c_xfer ... [ Upstream commit f4ee84f27625ce1fdf41e8483fa0561a1b837d10 ] In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9005_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-09-23 11:11:06 +02:00
..
a800.c	media: dvb-usb: a800: use an enum for the device number	2022-04-18 07:36:43 +02:00
af9005-fe.c
af9005-remote.c
af9005-script.h
af9005.c	media: af9005: Fix null-ptr-deref in af9005_i2c_xfer	2023-09-23 11:11:06 +02:00
af9005.h
az6027.c	media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()	2023-06-09 10:34:11 +02:00
az6027.h
cinergyT2-core.c	media: cinergyT2-core: use the newer dvb-usb macros for USB device	2022-04-18 07:36:43 +02:00
cinergyT2-fe.c
cinergyT2.h
cxusb-analog.c	media: Prefer designated initializers over memset for subdev pad ops	2023-05-24 17:32:36 +01:00
cxusb.c	media: cxusb: use the newer dvb-usb macros for USB device	2022-04-18 07:36:43 +02:00
cxusb.h
dib07x0.h
dib0700_core.c	media: dib0700: Only touch one bit when start/stop an adapter	2021-11-19 16:24:07 +00:00
dib0700_devices.c	media: dvb-usb: dib0700_devices: use an enum for the device number	2022-04-18 07:36:44 +02:00
dib0700.h
dibusb-common.c	media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()	2021-10-08 13:54:43 +02:00
dibusb-mb.c	media: dvb-usb: dibusb-mb: use an enum for the device number	2022-04-18 07:36:44 +02:00
dibusb-mc-common.c
dibusb-mc.c	media: dvb-usb: dibusb-mc: use an enum for the device number	2022-04-18 07:36:44 +02:00
dibusb.h
digitv.c	media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()	2023-06-09 10:34:11 +02:00
digitv.h
dtt200u-fe.c
dtt200u.c	media: dvb-usb: dtt200u: use an enum for the device number	2022-04-18 07:36:43 +02:00
dtt200u.h
dtv5100.c	media: dtv5100: use the newer dvb-usb macros for USB device	2022-04-18 07:36:43 +02:00
dtv5100.h
dvb-usb-common.h
dvb-usb-dvb.c
dvb-usb-firmware.c
dvb-usb-i2c.c
dvb-usb-init.c	media: dvb-usb: fix memory leak in dvb_usb_adapter_init()	2022-12-31 13:33:03 +01:00
dvb-usb-remote.c
dvb-usb-urb.c
dvb-usb.h
dw2102.c	media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()	2023-09-23 11:11:06 +02:00
dw2102.h
gp8psk.c	media: dvb-usb: gp8psk: use an enum for the device number	2022-04-18 07:36:43 +02:00
gp8psk.h
Kconfig	media: media/*/Kconfig: sort entries	2022-03-18 05:58:35 +01:00
m920x.c	media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()	2023-09-13 09:42:50 +02:00
m920x.h
Makefile
nova-t-usb2.c	media: dvb-usb: nova-t-usb2: use an enum for the device number	2022-04-18 07:36:44 +02:00
opera1.c	media: dvb-usb: opera1: use an enum for the device number	2022-04-18 07:36:44 +02:00
pctv452e.c	media: dvb-usb: pctv452e: use an enum for the device number	2022-04-18 07:36:44 +02:00
technisat-usb2.c	media: technisat-usb2: Fix comment typo	2022-08-29 15:32:14 +02:00
ttusb2.c	media: dvb-usb: ttusb2: use an enum for the device number	2022-04-18 07:36:44 +02:00
ttusb2.h
umt-010.c	media: dvb-usb: umt-010: use an enum for the device number	2022-04-18 07:36:44 +02:00
usb-urb.c
vp702x-fe.c
vp702x.c	media: dvb-usb: vp702x: use an enum for the device number	2022-04-18 07:36:44 +02:00
vp702x.h
vp7045-fe.c
vp7045.c	media: dvb-usb: vp7045: use an enum for the device number	2022-04-18 07:36:44 +02:00
vp7045.h