[media] usbvision: fix crash on detecting device with invalid configuration

The usbvision driver crashes when a specially crafted usb device with invalid
number of interfaces or endpoints is detected. This fix adds checks that the
device has proper configuration expected by the driver.

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

1 files changed, 15 insertions, 1 deletions

diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 3089d640c82d..de9ff3bb8edd 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -1470,9 +1470,23 @@ static int usbvision_probe(struct usb_interface *intf,
 
         if (usbvision_device_data[model].interface >= 0)
                 interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
-        else
+        else if (ifnum < dev->actconfig->desc.bNumInterfaces)
                 interface = &dev->actconfig->interface[ifnum]->altsetting[0];
+        else {
+                dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
+                    ifnum, dev->actconfig->desc.bNumInterfaces - 1);
+                ret = -ENODEV;
+                goto err_usb;
+        }
+
+        if (interface->desc.bNumEndpoints < 2) {
+                dev_err(&intf->dev, "interface %d has %d endpoints, but must"
+                    " have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
+                ret = -ENODEV;
+                goto err_usb;
+        }
         endpoint = &interface->endpoint[1].desc;
+
         if (!usb_endpoint_xfer_isoc(endpoint)) {
                 dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
                     __func__, ifnum);