lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 066/229] media: hdpvr: fix error value returns in hdpvr_read
    Date
    From: Niels Dossche <dossche.niels@gmail.com>

    [ Upstream commit 359c27c6ddbde404f44a9c0d3ec88ccd1e2042f2 ]

    Error return values are supposed to be negative in hdpvr_read. Most
    error returns are currently handled via an unsigned integer "ret". When
    setting a negative error value to "ret", the value actually becomes a
    large positive value, because "ret" is unsigned. Later on, the "ret"
    value is returned. But as ssize_t is a 64-bit signed number, the error
    return value stays a large positive integer instead of a negative
    integer. This can cause an error value to be interpreted as the read
    size, which can cause a buffer overread for applications relying on the
    returned size.

    Fixes: 9aba42efe85b ("V4L/DVB (11096): V4L2 Driver for the Hauppauge HD PVR usb capture device")
    Signed-off-by: Niels Dossche <dossche.niels@gmail.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/hdpvr/hdpvr-video.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
    index 1cecb37e16d2..59bd44736fae 100644
    --- a/drivers/media/usb/hdpvr/hdpvr-video.c
    +++ b/drivers/media/usb/hdpvr/hdpvr-video.c
    @@ -413,7 +413,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
    struct hdpvr_device *dev = video_drvdata(file);
    struct hdpvr_buffer *buf = NULL;
    struct urb *urb;
    - unsigned int ret = 0;
    + int ret = 0;
    int rem, cnt;

    if (*pos)
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-23 11:42    [W:5.242 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site