[PATCH] media: ttusb-dec: reject oversized packet lengths early

[Pengpeng Hou]

ttusb_dec_process_urb_frame() derives packet_payload_length directly
from bytes in the incoming USB stream and then uses that length to
append data into dec->packet[]. The driver only rejects oversized PVA
payloads later in ttusb_dec_process_pva(), after the receive state
machine has already filled the fixed packet buffer.

Reject packet lengths that cannot fit in dec->packet[] before advancing
the receive state machine to the bulk copy state.
---
 drivers/media/usb/ttusb-dec/ttusb_dec.c | 28 +++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index 825a3875989d..072ce5b09683 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -703,17 +703,41 @@ static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
 
 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
 			    dec->packet_length == 8) {
-				dec->packet_state++;
+				unsigned int max_payload_length;
+
 				dec->packet_payload_length = 8 +
 					(dec->packet[6] << 8) +
 					dec->packet[7];
+				max_payload_length = sizeof(dec->packet) - 4;
+				if (dec->packet_payload_length >
+				    max_payload_length) {
+					printk("%s: packet too long - discarding\n",
+					       __func__);
+					dec->packet_state = 0;
+					dec->packet_length = 0;
+					break;
+				}
+				dec->packet_state++;
 			} else if (dec->packet_type ==
 					TTUSB_DEC_PACKET_SECTION &&
 				   dec->packet_length == 5) {
-				dec->packet_state++;
+				unsigned int max_payload_length;
+
 				dec->packet_payload_length = 5 +
 					((dec->packet[3] & 0x0f) << 8) +
 					dec->packet[4];
+				max_payload_length = sizeof(dec->packet) - 4;
+				if (dec->packet_payload_length % 2)
+					max_payload_length--;
+				if (dec->packet_payload_length >
+				    max_payload_length) {
+					printk("%s: packet too long - discarding\n",
+					       __func__);
+					dec->packet_state = 0;
+					dec->packet_length = 0;
+					break;
+				}
+				dec->packet_state++;
 			}
 
 			length--;
-- 
2.50.1 (Apple Git-155)