From nobody Wed Jul 22 15:12:46 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h4yRf5pnDz6mFKs for ; Wed, 22 Jul 2026 15:12:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h4yRf4mB2z3kPy for ; Wed, 22 Jul 2026 15:12:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784733166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E6xeqFV68C8sRelTtvMntGKyHk3jHbkKMYh/PVVEjZM=; b=kkem4gV9bG8bB4ZvMQKZ3VSRCkMDM3ZWhb56Zwu1jM+yt7PNqFi0aBcmUYz3yTcW1U8CdL KqScNXV0d2qJut52j9ESmRXQ/dixBEKmGqfhC7UOzkutBRK3DygGmiOw8fdAuUQIvVvtWk qEYntNMnnOSWbv+GjIvIVrTG4/mkCfKN0fJd3QBPpG2LGnPfIjuXh6vOrpIrU/1MaN02qN qbC4CxnCzulsKVmncpkvOwudz0z1OwTHLdkUDI3RggZuA1I4JiB9V4SPuIM4KOBRVce0ZR u84bh8S850B5M0VnLENph6Ci9/bR+FEp2WFS9qr16Gmsw+WSrTr8SEpHPD9ToA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784733166; a=rsa-sha256; cv=none; b=oDCs3CYDAVToVKon0Oaxoz/FGV3HfI+orQP2VumR6X1RE23+QND1gUxYape7RIzR1rOBlS d94Lgv6WWEMS2JrxxH9BXw036ZOD99WuPjFlnh0bfNSsvvtqZd4nmm+lCctxzXF575PKHl yK9DD/D+VadMTuyj34WCt6sXh1+2GThdTJ9vAIHKdVicWpAJgF+seMd+MWrtlCSFTDwK8h VUHRZOn++qbTw2zPNkup/5jRhFv1bvwR/CHmI/msx9GsODD9V/5VpgvTWFcXzWyjnApVez XwYafbEIW7GdXOGaDHiW8nLevepFSpGvAiUzi4QakCisQnR2uiz1FCt3N3Y9tQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784733166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E6xeqFV68C8sRelTtvMntGKyHk3jHbkKMYh/PVVEjZM=; b=T7UAQGiq1zqYP8s8R2acfzI1ltu9INrksNse96FouW8kBZx72UawFo1QPg/LqSmCIKn/ed QZixXvfOYbWHo/J6ojbzZira3oAkYhAqRFkhOsOQsdF8QltvA9N8x4EPl+Y/tIc1djhSBf E2fs2TWaA6CDQWFxrOvcgKYcPx1TApdR3bLkH/kcZxUr1RZxiAwV5bkybACdmHs7QYn2Wi i29m7L9ViZujJzJnFb2rW8WmYf3iQUxiVktGSFSiOJ9/Im7L1VBoLqMHjsIDf11xzFfyWn 6ukqW9g2ot+v7Wbg8RpeB2lPYIyQMjokl+8eSDp+BU5UAZWFwz1z1pJX1yfUkQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h4yRf37gyz83x for ; Wed, 22 Jul 2026 15:12:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 34719 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 22 Jul 2026 15:12:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Baptiste Daroussin Subject: git: 4b9d794b6aa8 - main - uvideo: validate frame size before mmap buffer allocation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bapt X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4b9d794b6aa86a2b205e480928552d3f606d9bcc Auto-Submitted: auto-generated Date: Wed, 22 Jul 2026 15:12:46 +0000 Message-Id: <6a60ddee.34719.708b084f@gitrepo.freebsd.org> The branch main has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=4b9d794b6aa86a2b205e480928552d3f606d9bcc commit 4b9d794b6aa86a2b205e480928552d3f606d9bcc Author: Baptiste Daroussin AuthorDate: 2026-07-22 07:25:52 +0000 Commit: Baptiste Daroussin CommitDate: 2026-07-22 15:10:57 +0000 uvideo: validate frame size before mmap buffer allocation dwMaxVideoFrameSize comes from the USB probe/commit response and is not validated. reqbufs() computed buf_size_total with signed int arithmetic and no bound, so a bogus value could wrap the product to a small size and yield a too-small buffer with a huge sc_mmap_buffer_size, causing out-of-bounds writes from the USB transfer callbacks. Bound the frame size against sc_max_fbuf_size and use overflow-checked size_t arithmetic for the total and per-buffer offsets. Reported by: emaste --- sys/dev/usb/video/uvideo.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/sys/dev/usb/video/uvideo.c b/sys/dev/usb/video/uvideo.c index bb4d42778998..9c6076bc76d0 100644 --- a/sys/dev/usb/video/uvideo.c +++ b/sys/dev/usb/video/uvideo.c @@ -3531,7 +3531,9 @@ uvideo_g_input(struct uvideo_softc *sc, int *input) static int uvideo_reqbufs(struct uvideo_softc *sc, struct v4l2_requestbuffers *rb) { - int i, buf_size, buf_size_total; + int i; + uint32_t buf_size; + size_t buf_size_total; vm_object_t obj; vm_offset_t kva; int error; @@ -3552,7 +3554,12 @@ uvideo_reqbufs(struct uvideo_softc *sc, struct v4l2_requestbuffers *rb) sc->sc_mmap_count = rb->count; buf_size = UGETDW(sc->sc_desc_probe.dwMaxVideoFrameSize); - buf_size_total = sc->sc_mmap_count * buf_size; + if (buf_size == 0 || sc->sc_max_fbuf_size <= 0 || + buf_size > (u_int)sc->sc_max_fbuf_size) + return (EINVAL); + if (SIZE_MAX / sc->sc_mmap_count < buf_size) + return (EINVAL); + buf_size_total = (size_t)sc->sc_mmap_count * buf_size; buf_size_total = round_page(buf_size_total); /* @@ -3599,10 +3606,11 @@ uvideo_reqbufs(struct uvideo_softc *sc, struct v4l2_requestbuffers *rb) buf_size_total, (uintmax_t)kva); for (i = 0; i < sc->sc_mmap_count; i++) { - sc->sc_mmap[i].buf = sc->sc_mmap_buffer + (i * buf_size); + sc->sc_mmap[i].buf = sc->sc_mmap_buffer + + ((size_t)i * buf_size); sc->sc_mmap[i].v4l2_buf.index = i; - sc->sc_mmap[i].v4l2_buf.m.offset = i * buf_size; + sc->sc_mmap[i].v4l2_buf.m.offset = (size_t)i * buf_size; sc->sc_mmap[i].v4l2_buf.length = buf_size; sc->sc_mmap[i].v4l2_buf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; sc->sc_mmap[i].v4l2_buf.sequence = 0;