CVE-2024-38621

In the Linux kernel, the following vulnerability has been resolved: media:
stk1160: fix bounds checking in stk1160_copy_video() The subtract in this
condition is reversed. The ->length is the length of the buffer. The
->bytesused is how many bytes we have copied thus far. When the condition
is reversed that means the result of the subtraction is always negative but
since it’s unsigned then the result is a very high positive value. That
means the overflow check is never true. Additionally, the ->bytesused
doesn’t actually work for this purpose because we’re not writing to
“buf->mem + buf->bytesused”. Instead, the math to calculate the destination
where we are writing is a bit involved. You calculate the number of full
lines already written, multiply by two, skip a line if necessary so that we
start on an odd numbered line, and add the offset into the line. To fix
this buffer overflow, just take the actual destination where we are
writing, if the offset is already out of bounds print an error and return.
Otherwise, write up to buf->length bytes.