In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: vicodec: fix out-of-bounds write in FWHT encoder<\/p>\n
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
\ncompressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
\ncoded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()
\nencodes one plane per component, and an incompressible plane takes the
\nFWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.<\/p>\n
For a 4-component pixel format all four planes are full resolution
\n(width_div == height_div == 1), so a frame that forces every plane
\nthrough the unencoded fallback writes
\nsizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning
\nthe plane by coded_w * coded_h, which can result in corruption
\nof adjacent kernel heap memory.<\/p>\n
Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest
\ncomponents_num among the supported raw formats, so the capture buffer is
\nalways large enough for the unencoded fallback.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: vicodec: fix out-of-bounds write in FWHT encoder<\/p>\n
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
\ncompresse<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21646","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}