[PATCH v2] media: ttusb-dec: reject oversized packet lengths

ttusb_dec_process_urb_frame() derives the packet payload length from
the PVA/SECTION header, up to 8 + 0xffff = 65543 bytes, and uses it in
the bulk-copy state to memcpy() into dec->packet[], a fixed 6148-byte
buffer. A malicious or faulty Technotrend TT-USB DEC device can
therefore drive a heap out-of-bounds write of up to ~59 KB past the
buffer, over function pointers in struct ttusb_dec and adjacent
allocations. The only existing length check, in ttusb_dec_process_pva(),
runs after the bulk copy, too late to help.

Reject the packet in the header state, as soon as the advertised length
is known and before any bulk copy. Both PVA and section packets are
covered, and the check leaves room for the up-to-five bytes appended
after the payload (4-byte trailer plus one padding byte for odd-sized
section payloads).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: [email protected]
Reported-by: Seungjin Bae <[email protected]>
Closes: https://lore.kernel.org/linux-media/[email protected]/
Reported-by: Pengpeng Hou <[email protected]>
Closes: https://lore.kernel.org/linux-media/[email protected]/
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <[email protected]>
---
This bug was previously reported and fixes were posted in Dec 2025 and
Mar 2026 but did not receive any maintainer response; it is still
present in master. This version also rejects section packets (not just
PVA) and accounts for the post-payload trailer, which earlier attempts
missed.

Verified with KASAN: without the check, a crafted packet yields
"BUG: KASAN: slab-out-of-bounds ... Write of size 65535"; with the
check, the packet is rejected and no overflow occurs.

Changes in v2:
- The v1 mail carried a corrupted diff (a "\n" in the dev_warn string
  was expanded into a literal newline), so the patch did not apply.
  Resend with no other changes.
---
 drivers/media/usb/ttusb-dec/ttusb_dec.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index 825a3875989d32ddbb65589f7015acee96a44c9e..58628846d9e23b225c9939784bcbae7825642fdd 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -700,23 +700,33 @@ static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
 
 		case 5:
 			dec->packet[dec->packet_length++] = *b++;
+			length--;
 
 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
 			    dec->packet_length == 8) {
-				dec->packet_state++;
 				dec->packet_payload_length = 8 +
 					(dec->packet[6] << 8) +
 					dec->packet[7];
 			} else if (dec->packet_type ==
 					TTUSB_DEC_PACKET_SECTION &&
 				   dec->packet_length == 5) {
-				dec->packet_state++;
 				dec->packet_payload_length = 5 +
 					((dec->packet[3] & 0x0f) << 8) +
 					dec->packet[4];
+			} else {
+				break;
+			}
+
+			if (dec->packet_payload_length + 5 >
+			    sizeof(dec->packet)) {
+				dev_warn_ratelimited(&dec->udev->dev,
+						     "%s: packet too long - discarding\n",
+						     __func__);
+				dec->packet_state = 0;
+			} else {
+				dec->packet_state++;
 			}
 
-			length--;
 			break;
 
 		case 6: {

---
base-commit: 66fb95a521110da673090294561844c9f76ebe64
change-id: 20260825-ttusb-dec-overflow-0d1f7fc2e308

Best regards,
-- 
Shengzhuo Wei <[email protected]>