diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-03-04 08:12:06 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-03-04 08:12:06 -0800 |
| commit | 4053c47680da0a03a8df66735904d5b92db6a144 (patch) | |
| tree | d1418b7af38e014d577300b601a19e0af1ebb6bc | |
| parent | 40d3f622477ccd99118498df5283941bf546dd9c (diff) | |
| parent | 24d87712727a5017ad142d63940589a36cd25647 (diff) | |
Merge tag 'media/v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fix from Mauro Carvalho Chehab:
"Fix for MPEG-TS decoder in dvb-net"
* tag 'media/v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
media: dvb-net: fix OOB access in ULE extension header tables
| -rw-r--r-- | drivers/media/dvb-core/dvb_net.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c index 8bb8dd34c223..a2159b2bc176 100644 --- a/drivers/media/dvb-core/dvb_net.c +++ b/drivers/media/dvb-core/dvb_net.c @@ -228,6 +228,9 @@ static int handle_one_ule_extension( struct dvb_net_priv *p ) unsigned char hlen = (p->ule_sndu_type & 0x0700) >> 8; unsigned char htype = p->ule_sndu_type & 0x00FF; + if (htype >= ARRAY_SIZE(ule_mandatory_ext_handlers)) + return -1; + /* Discriminate mandatory and optional extension headers. */ if (hlen == 0) { /* Mandatory extension header */ |