[PATCH] media: dvb-core: initialize TS feed cleanup fields

[Yousef Alhouseen]

dmx_ts_feed_set() validates the requested PID and decoder type before it
assigns feed->ts_type and feed->pes_type. If validation fails, dmxdev
releases the newly allocated feed, and dvbdmx_release_ts_feed() reads both
uninitialized fields. A random TS_DECODER bit can also make cleanup use an
uninitialized PES type as an array index.

Initialize new feeds as non-decoder, DMX_PES_OTHER feeds so release is
safe before the set operation succeeds.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+01d4620886bee3db0e74@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=01d4620886bee3db0e74
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
 drivers/media/dvb-core/dvb_demux.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index 290fc7961647..ed77e0bfb8e2 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -810,6 +810,8 @@ static int dvbdmx_allocate_ts_feed(struct dmx_demux *dmx,
 	feed->pid = 0xffff;
 	feed->peslen = 0xfffa;
 	feed->buffer_flags = 0;
+	feed->ts_type = 0;
+	feed->pes_type = DMX_PES_OTHER;
 
 	(*ts_feed) = &feed->feed.ts;
 	(*ts_feed)->parent = dmx;
-- 
2.54.0