aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2017-09-20 18:19:59 -0400
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2017-12-14 09:51:17 -0500
commita24e6348e5a0e8562ad64d760c25907ed088611c (patch)
tree609d0b1b3772025a9514dea1398e95d70dad90e4
parent3ee6229f1a16ad80ac83f02614f46b70b7ecf666 (diff)
media: dvb_ca_en50221: sanity check slot number from userspace
Currently a user can pass in an unsanitized slot number which will lead to and out of range index into ca->slot_info. Fix this by checking that the slot number is no more than the allowed maximum number of slots. Seems that this bug has been in the driver forever. Detected by CoverityScan, CID#139381 ("Untrusted pointer read") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
-rw-r--r--drivers/media/dvb-core/dvb_ca_en50221.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index d48b61eb01f4..a3b2754e7124 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -1473,6 +1473,9 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
return -EFAULT;
buf += 2;
count -= 2;
+
+ if (slot >= ca->slot_count)
+ return -EINVAL;
sl = &ca->slot_info[slot];
/* check if the slot is actually running */

Privacy Policy