Unbounded loop in cxm_saa7115_configure reads past saa7115_scalings[]/saa7115_audio_clock[] (missing i< before NUM_ELEMENTS)
Summary
cxm_saa7115.c:825 for (i=0; NUM_ELEMENTS(saa7115_scalings); i++) missing i< before NUM_ELEMENTS -> constant 6 truthy -> always true. 894 same for saa7115_audio_clock constant 4. Loop exits only via break on match; no-match reads past static const tables OOB. Post-loop guard if(i>=NUM_ELEMENTS) unreachable on no-match path. Latent: sole caller cxm_configure_encoder passes only valid codec_profile tuples. If future profile with unrepresented dimensions/sample_rate -> OOB read panic or wild pointer deref at 834/902. Fix: for(i=0;i<NUM_ELEMENTS(...);i++).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1622 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Unbounded loop in cxm_saa7115_configure reads past saa7115_scalings[]/saa7115_au | 470 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/video/cxm/cxm_saa7115.c:825: unbounded loop (missing i< before NUM_ELEMENTS)
Verified recommended fix
Source-confirmed at sys/dev/video/cxm/cxm_saa7115.c:825: unbounded loop (missing i< before NUM_ELEMENTS)
Verdict
Source-confirmed at sys/dev/video/cxm/cxm_saa7115.c:825: unbounded loop (missing i< before NUM_ELEMENTS)
No comments yet.