In chdk_camera_capture_preview(), the memset for bmd was incorrectly
using &vpd as the target, leaving bmd uninitialized with stack garbage.
This is a copy-paste error from the memset line above for vpd.
In ptp_chdk_parse_live_data(), the bitmap framebuffer descriptor (bmd)
was being unpacked using header->vp_desc_start instead of the correct
header->bm_desc_start offset. This is a copy-paste error from the line
above that unpacks the viewport descriptor (vpd).
Disable call to ptp_getobjecthandles() with storageid = PTP_HANDLER_SPECIAL
(0xffffffff)
< 2020 cameras hang, > 2020 cameras return PTP_RC_StoreNotAvailable.
From Sony docs:
2.00 - ptp_getobjecthandles() not documented / not recommended
3.00 - ptp_getobjecthandles() with 0xffffffff not supported
ptp_unpack_Sony_DPD() reads the FormFlag byte via dtoh8o(data, *poffset)
without a prior bounds check. The standard ptp_unpack_DPD() at line
686–687 correctly validates *offset + sizeof(uint8_t) > dpdlen before
this same read, but the Sony variant omits this check.
CVE-2026-40339
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
In the PTP_DPFF_Enumeration case of ptp_unpack_Sony_DPD(), dtoh16o(data, *poffset) reads 2 bytes for enumeration count N without verifying 2 bytes remain. The standard parser at line 704 has this check.
CVE-2026-40338
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
Finding 5: UINT128/INT128 Unchecked Offset Advance (CWE-125) — MEDIUM
In ptp_unpack_DPV(), the PTP_DTC_UINT128 and PTP_DTC_INT128 cases advance *offset += 16 without verifying 16 bytes remain. The entry check at line 609 only guarantees *offset < total (at least 1 byte available). After the unchecked advance, *offset can exceed total, and the CTVAL macro's bounds check (total - *offset < sizeof(target)) wraps due to unsigned arithmetic.
CVE-2026-40335
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
ptp_unpack_Canon_FE() copies filename with strncpy into a 13-byte
buffer without explicit null termination. The EOS variant at line
1451–1452 correctly adds fe->Filename[PTP_CANON_FilenameBufferLen-1]
= 0; confirming this was recognized as necessary but not applied to the
original Canon path.
CVE-2026-40334
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
ptp_unpack_OI() validates len < PTP_oi_SequenceNumber (i.e., len < 48) but then accesses:
Offsets 48–51: dtoh32a(data + PTP_oi_SequenceNumber) at line 563 (4 bytes OOB)
Offset 52: data[PTP_oi_filenamelen] at line 547 (5 bytes OOB)
Offset 56: data[PTP_oi_filenamelen+4] at line 547 (9 bytes OOB)
The Samsung Galaxy 64-bit objectsize detection heuristic reads up to 9 bytes beyond the validated boundary.
CVE-2026-40340
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() accept
const unsigned char** data but no length/size parameter. They perform
unbounded reads via dtoh32o calls (up to 36 bytes for ImageFormat,
up to 1024 bytes for CustomFuncEx). Callers in ptp_unpack_EOS_events()
have xsize available but never pass it.
CVE-2026-40333
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
Finding 4: Sony DPD Secondary Enum List Memory Leak (CWE-401) — LOW
File: ptp-pack.c:884-885
When processing a secondary enumeration list (2024+ Sony cameras), line
884–885 overwrites dpd->FORM.Enum.SupportedValue with a new calloc()
without freeing the previous allocation from line 857. The original
array and any string values it contains are leaked.
CVE-2026-40336
Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
C23 treats the return values of strrchr() and strchr() as const char *
when the input string is const-qualified. Update local variables to use
const char * where appropriate to avoid discarded-qualifier warnings and
build failures with -std=gnu23.
No functional change intended.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Check return to see if we got mode 200 properties so we can tell when dealing with older cameras.
Tested with:
- A99V (2012)
- A7R3 (2017)
- Several newer cameras
The Pentax scsi driver requires the camera to be in MSC mode. The K1-II uses different product IDs for MSC and PTP mode, and the wrong USB product ID was copied from the referenced thread.
