⬢ DragonFlyBSD Kernel Audit
DF-2351 / fix_run.log
← back to finding ↓ download raw
login: RIG2351: === DF-2351: uint16->uint8 truncation of nfmt ===
RIG2351: crafted cdesc len=2869 (256 VS_FORMAT_MJPEG, 0 frames)
RIG2351: production uvc_drv_init_data_fmt ret=0
RIG2351: counted nfmt=256 (uint16_t local) -> stored data->nfmt=256 nfrm=0 nitv=0 fmt=0xfffff80118660000  <-- TRUNCATION if nfmt==0
RIG2351: production uvc_drv_parse_data ret=0 (data->nfmt=256)
RIG2351: entering production uvc_drv_init_cur_fmt_frm with data->nfmt==0 -- search loop is skipped, fmt stays NULL, fmt->nfrm dereferences NULL (uvc_drv.c:1463). Expect panic.
No frame desc found for default format.
RIG2351: init_cur_fmt_frm returned 22 -- NO PANIC (unexpected on unpatched code)