In dvb_video_write(), the first header byte of the buffer 'buf' supplied by the user is checked to see whether 'buf' contains a TS packet, which always starts with 0x47 for synchronization purposes. If yes, ts_play() is called. Otherwise, dvb_play() will be called. Both of these two functions will copy 'buf' again from the user space. However, no check is enforced on the first byte of the copied content after the second copy. Since 'buf' is in the user space, a malicious user can race to change the first byte after the check in dvb_video_write() but before the second copy in ts_play(). By doing so, the user can supply inconsistent data, which can lead to undefined behavior in the driver. This patch adds the required check in ts_play() to make sure the header byte in the second copy is as expected. Otherwise an error code EINVAL will be returned. Signed-off-by: Wenwen Wang <wang6495@xxxxxxx> --- drivers/media/pci/ttpci/av7110_av.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c index ef1bc17..1ff6062 100644 --- a/drivers/media/pci/ttpci/av7110_av.c +++ b/drivers/media/pci/ttpci/av7110_av.c @@ -468,6 +468,8 @@ static ssize_t ts_play(struct av7110 *av7110, const char __user *buf, } if (copy_from_user(kb, buf, TS_SIZE)) return -EFAULT; + if (kb[0] != 0x47) + return -EINVAL; write_ts_to_decoder(av7110, type, kb, TS_SIZE); todo -= TS_SIZE; buf += TS_SIZE; -- 2.7.4
