]> git.baikalelectronics.ru Git - kernel.git/commit
media: dvb_ca_en50221: sanity check slot number from userspace
authorColin Ian King <colin.king@canonical.com>
Wed, 20 Sep 2017 22:19:59 +0000 (18:19 -0400)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Thu, 14 Dec 2017 14:51:17 +0000 (09:51 -0500)
commit9097d71a21bc855640563edc95c8b54d5b677f3a
tree609d0b1b3772025a9514dea1398e95d70dad90e4
parent9527db19b1f924f75cd5637bc3ed1b4f3c85d13b
media: dvb_ca_en50221: sanity check slot number from userspace

Currently a user can pass in an unsanitized slot number which
will lead to and out of range index into ca->slot_info. Fix this
by checking that the slot number is no more than the allowed
maximum number of slots. Seems that this bug has been in the driver
forever.

Detected by CoverityScan, CID#139381 ("Untrusted pointer read")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jasmin Jessich <jasmin@anw.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/media/dvb-core/dvb_ca_en50221.c