From nobody Wed Jul 22 15:12:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h4yRj1Pyrz6mFTn for ; Wed, 22 Jul 2026 15:12:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h4yRh6WYtz3kjX for ; Wed, 22 Jul 2026 15:12:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784733169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xs96SD9lX6WdLOW4gp4dcoI6X0eEbOihpSa18ZM89SU=; b=IidoM3RKZsNkvBTeHwIfzls8GxqV6MaRP/EaNPTweizYZtj1x4rjWkyloKxBUHZMCTtAu2 DU/JM8Sr3CGCE5DkoDfcFmIM17FXFlQETBqNW9sL2SAN8cmEcgPLFtH76tUWLmk63aVsFk gQn9k6JWp2OJ989WEfsP3AJ+8rpm9ipfqBGCWwPbK5QcgaaanXWQoG8k+FKU0IMDa+56FS BcSDVYrihfIst83y8Q48xCOxlVMGNP1TFcWupSiNyP5nmKEU9jupr14vt0tHPgNqHXUIxz iMSZAk6oTsSQMQLXQ989lcFhnqTw7i8VOO1caCdTooPkIP84/ryKJmoI4p4eEQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784733169; a=rsa-sha256; cv=none; b=GoXpUTds+G6/cCr84ippbyOQVJB1l5Mvj+HQyentIj0KfT8UEav2SKZGz+09oVaYtYk6iS JHfXnJ2o/aquZfyVwLsu9KrnZZ88bG9K1YR6uqL8GVAiZlRj1dPKnWM1Q3mX0vx3xL2vaB Gz046PY7aaPQXbeIZCQLpgxqBaDhYZpCJpaBP+KpdIYW08J+F+BXV91snn9TvYL8g3fvD1 KYd6nJ6buU6vhb2phiraZDQDsyu8YttTmhgnQVwwjod6Uypu4EKKUyXOtweYdM110+i7eV K4v00BVqe6Gi7iOU7Pfl6uT3zYSSNfrQ5Xjvk0zliJX0hY1rjHiDilyIZJhfHw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784733169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xs96SD9lX6WdLOW4gp4dcoI6X0eEbOihpSa18ZM89SU=; b=EyiCUz+SH5w1XZRu+uzibaSQ+kqGN+gtVCbE+VUjhUxttagVeAORcY+DL/CPWtprom6Ouy lWvl3fbLbpmTiUdqWCe5UBuWguGn4B+tXqdh6AY74iNHSf9Gq6I9LTWzmNCmPsKp51d4kG TU1kECrjmpnO87Ar8TyAOXRGWAtCOeqjq48o4y0Z0g/HkIE3tblNESIUcVb7xqSrpjXnN6 PvTAPqmqoT1n28c6qKcuB2OktEVLWXS7SbNg7u3+525tuECkOnt/Tuy56Jag+zs4CBv20+ BgOgaKJQLz6Ngw/87BcedVwjHdePVtXT21JEdnmkS2p2V+kls9Bs+9V6Ybwk1w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h4yRh4q0Fz7bm for ; Wed, 22 Jul 2026 15:12:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3377f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 22 Jul 2026 15:12:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Baptiste Daroussin Subject: git: cb26bda8ca36 - main - uvideo: bounds-check frame interval reads against bLength List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bapt X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: cb26bda8ca36e0e421f75d82e1aa46df8f2ff814 Auto-Submitted: auto-generated Date: Wed, 22 Jul 2026 15:12:48 +0000 Message-Id: <6a60ddf0.3377f.5adea594@gitrepo.freebsd.org> The branch main has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=cb26bda8ca36e0e421f75d82e1aa46df8f2ff814 commit cb26bda8ca36e0e421f75d82e1aa46df8f2ff814 Author: Baptiste Daroussin AuthorDate: 2026-07-22 07:42:29 +0000 Commit: Baptiste Daroussin CommitDate: 2026-07-22 15:10:57 +0000 uvideo: bounds-check frame interval reads against bLength Frame interval data is read from device-supplied frame descriptors whose bLength may be shorter than the number of intervals declared by bFrameIntervalType. The continuous branch of uvideo_enum_fivals() read three intervals unconditionally, and the discrete branch checked the pointer but not the four bytes that UGETDW() reads, so a short or malformed descriptor could read past bLength and leak adjacent kernel memory to userspace. uvideo_vs_parse_desc_frame_max_rate() had the same class of off-by-up-to-three-bytes read. Compute the available bytes from bLength and validate before each read. Reported by: emaste --- sys/dev/usb/video/uvideo.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/sys/dev/usb/video/uvideo.c b/sys/dev/usb/video/uvideo.c index 708660adeafb..ac54eba19695 100644 --- a/sys/dev/usb/video/uvideo.c +++ b/sys/dev/usb/video/uvideo.c @@ -1791,7 +1791,7 @@ uvideo_vs_parse_desc_frame_max_rate(struct uvideo_softc *sc, nivals = UVIDEO_FRAME_NUM_INTERVALS(fd); for (i = 0; i < nivals; i++) { - if (length <= 0) + if (length < (int)sizeof(uDWord)) break; next_frame_ival = UGETDW(p); if (next_frame_ival > frame_ival) @@ -3294,7 +3294,7 @@ uvideo_enum_fsizes(struct uvideo_softc *sc, struct v4l2_frmsizeenum *fsizes) static int uvideo_enum_fivals(struct uvideo_softc *sc, struct v4l2_frmivalenum *fivals) { - int idx; + int idx, ival_bytes; struct uvideo_format_group *fmtgrp = NULL; struct usb_video_frame_desc *frame = NULL; uint8_t *p; @@ -3327,6 +3327,9 @@ uvideo_enum_fivals(struct uvideo_softc *sc, struct v4l2_frmivalenum *fivals) return (EINVAL); p = (uint8_t *)frame + UVIDEO_FRAME_MIN_LEN(frame); + ival_bytes = (int)frame->bLength - (int)UVIDEO_FRAME_MIN_LEN(frame); + if (ival_bytes < 0) + return (EINVAL); bzero(fivals, sizeof(*fivals)); fivals->index = fi_index; @@ -3337,6 +3340,8 @@ uvideo_enum_fivals(struct uvideo_softc *sc, struct v4l2_frmivalenum *fivals) if (UVIDEO_FRAME_NUM_INTERVALS(frame) == 0) { if (fi_index != 0) return (EINVAL); + if (ival_bytes < (int)(3 * sizeof(uDWord))) + return (EINVAL); fivals->type = V4L2_FRMIVAL_TYPE_STEPWISE; fivals->stepwise.min.numerator = UGETDW(p); fivals->stepwise.min.denominator = 10000000; @@ -3349,12 +3354,9 @@ uvideo_enum_fivals(struct uvideo_softc *sc, struct v4l2_frmivalenum *fivals) } else { if (fi_index >= (uint32_t)UVIDEO_FRAME_NUM_INTERVALS(frame)) return (EINVAL); - p += sizeof(uDWord) * fi_index; - if (p > frame->bLength + (uint8_t *)frame) { - device_printf(sc->sc_dev, - "frame desc too short?\n"); + if (ival_bytes < (int)((fi_index + 1) * sizeof(uDWord))) return (EINVAL); - } + p += sizeof(uDWord) * fi_index; fivals->type = V4L2_FRMIVAL_TYPE_DISCRETE; fivals->discrete.numerator = UGETDW(p); fivals->discrete.denominator = 10000000;