lkml.org 
[lkml]   [2019]   [Sep]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 59/59] media: technisat-usb2: break out of loop at end of buffer
    Date
    From: Sean Young <sean@mess.org>

    commit 0c4df39e504bf925ab666132ac3c98d6cbbe380b upstream.

    Ensure we do not access the buffer beyond the end if no 0xff byte
    is encountered.

    Reported-by: syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com
    Signed-off-by: Sean Young <sean@mess.org>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/dvb-usb/technisat-usb2.c | 22 ++++++++++------------
    1 file changed, 10 insertions(+), 12 deletions(-)

    --- a/drivers/media/usb/dvb-usb/technisat-usb2.c
    +++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
    @@ -607,10 +607,9 @@ static int technisat_usb2_frontend_attac
    static int technisat_usb2_get_ir(struct dvb_usb_device *d)
    {
    struct technisat_usb2_state *state = d->priv;
    - u8 *buf = state->buf;
    - u8 *b;
    - int ret;
    struct ir_raw_event ev;
    + u8 *buf = state->buf;
    + int i, ret;

    buf[0] = GET_IR_DATA_VENDOR_REQUEST;
    buf[1] = 0x08;
    @@ -646,26 +645,25 @@ unlock:
    return 0; /* no key pressed */

    /* decoding */
    - b = buf+1;

    #if 0
    deb_rc("RC: %d ", ret);
    - debug_dump(b, ret, deb_rc);
    + debug_dump(buf + 1, ret, deb_rc);
    #endif

    ev.pulse = 0;
    - while (1) {
    - ev.pulse = !ev.pulse;
    - ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000;
    - ir_raw_event_store(d->rc_dev, &ev);
    -
    - b++;
    - if (*b == 0xff) {
    + for (i = 1; i < ARRAY_SIZE(state->buf); i++) {
    + if (buf[i] == 0xff) {
    ev.pulse = 0;
    ev.duration = 888888*2;
    ir_raw_event_store(d->rc_dev, &ev);
    break;
    }
    +
    + ev.pulse = !ev.pulse;
    + ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR *
    + FIRMWARE_CLOCK_TICK) / 1000;
    + ir_raw_event_store(d->rc_dev, &ev);
    }

    ir_raw_event_handle(d->rc_dev);

    \
     
     \ /
      Last update: 2019-09-20 00:18    [W:3.516 / U:0.480 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site