Description
In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common When VIDIOC_TRY_FMT is called with an unsupported pixel format on the OUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2. However, if a distro has locally patched MPEG2 support out (as it has been broken for some time) the platform format table does not contain MPEG2 so find_format() returns NULL and the subsequent dereference of fmt_out->max_width triggers a NULL pointer dereference. Fix this by falling back to the first format in the platform's format array instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid since every platform defines at least one format.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3e7f51bd96077acad6acd7b45668f65b44233c4e to < 276f28672bb6d5d5feca78db4219c7b5adf1be26affected3e7f51bd96077acad6acd7b45668f65b44233c4e to < c620906fb1b2ad75d408ea9d06040d66952d4a31affected3e7f51bd96077acad6acd7b45668f65b44233c4e to < 3839b6be2279fc4f558723f2c0fbfc9c42070958affected3e7f51bd96077acad6acd7b45668f65b44233c4e to < 680a89683197cdfe4e03e6fd7755454c647d39c1affected3e7f51bd96077acad6acd7b45668f65b44233c4e to < f2375a308640e401c142c5426d52c3d10e016d25affected3e7f51bd96077acad6acd7b45668f65b44233c4e to < 96dafbae77f50bfe2228bcfedcd8652c5e5f08e8affected3e7f51bd96077acad6acd7b45668f65b44233c4e to < d61ba609c3226af3c84268ba606ea06ee63e511baffected3e7f51bd96077acad6acd7b45668f65b44233c4e to < 20aa934ace6917262ff579a73ec018d06a7bad1caffected
Linux Linux
Default version status: affected
5.3affected0 to < 5.3unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/276f28672bb6d5d5feca78db4219c7b5adf1be26 ↗
- https://git.kernel.org/stable/c/c620906fb1b2ad75d408ea9d06040d66952d4a31 ↗
- https://git.kernel.org/stable/c/3839b6be2279fc4f558723f2c0fbfc9c42070958 ↗
- https://git.kernel.org/stable/c/680a89683197cdfe4e03e6fd7755454c647d39c1 ↗
- https://git.kernel.org/stable/c/f2375a308640e401c142c5426d52c3d10e016d25 ↗
- https://git.kernel.org/stable/c/96dafbae77f50bfe2228bcfedcd8652c5e5f08e8 ↗
- https://git.kernel.org/stable/c/d61ba609c3226af3c84268ba606ea06ee63e511b ↗
- https://git.kernel.org/stable/c/20aa934ace6917262ff579a73ec018d06a7bad1c ↗