[PATCH] media: uvcvideo: skip bulk output URBs smaller than the payload header

[Louis Clinckx]

For a bulk video output stream, uvc_video_encode_bulk() starts each
payload by writing a fixed 2-byte header with uvc_video_encode_header()
and subtracts it from a signed length counter initialised to the URB
size:

	int len = stream->urb_size;
	...
	len -= uvc_video_encode_header(...);	/* always returns 2 */

An output device can describe a bulk endpoint with wMaxPacketSize 1 and
negotiate dwMaxPayloadTransferSize 1, which leaves stream->urb_size == 1.
len then becomes -1, and uvc_video_encode_data() casts it to unsigned:

	nbytes = min((unsigned int)len, buf->bytesused - queue->buf_used);

so (unsigned)-1 does not clamp and the following memcpy() copies the
whole frame past the one-byte URB buffer.

A URB that cannot hold the 2-byte header cannot carry a payload, so skip
it instead of letting the length underflow.

Signed-off-by: Louis Clinckx <clinckx.louis@xxxxxxxxx>
---
 drivers/media/usb/uvc/uvc_video.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1701,7 +1701,14 @@ static void uvc_video_encode_bulk(struct uvc_urb *uvc_urb,
 	if (buf == NULL) {
 		urb->transfer_buffer_length = 0;
 		return;
 	}
 
+	/* The 2-byte payload header must fit; a smaller URB would make len
+	 * underflow and uvc_video_encode_data() copy past the buffer. */
+	if (len < 2) {
+		urb->transfer_buffer_length = 0;
+		return;
+	}
+
 	/* If the URB is the first of its payload, add the header. */
 	if (stream->bulk.header_size == 0) {