| Révision | 994c6dcb4307759d440b8031e140d343b8611481 (tree) |
|---|---|
| l'heure | 2019-09-21 14:14:22 |
| Auteur | Sean Young <sean@mess...> |
| Commiter | Greg Kroah-Hartman |
media: technisat-usb2: break out of loop at end of buffer
commit 0c4df39e504bf925ab666132ac3c98d6cbbe380b upstream.
Ensure we do not access the buffer beyond the end if no 0xff byte
is encountered.
Reported-by: syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/usb/dvb-usb/technisat-usb2.c (diff)| @@ -612,10 +612,9 @@ static int technisat_usb2_frontend_attach(struct dvb_usb_adapter *a) | ||
| 612 | 612 | static int technisat_usb2_get_ir(struct dvb_usb_device *d) |
| 613 | 613 | { |
| 614 | 614 | struct technisat_usb2_state *state = d->priv; |
| 615 | - u8 *buf = state->buf; | |
| 616 | - u8 *b; | |
| 617 | - int ret; | |
| 618 | 615 | struct ir_raw_event ev; |
| 616 | + u8 *buf = state->buf; | |
| 617 | + int i, ret; | |
| 619 | 618 | |
| 620 | 619 | buf[0] = GET_IR_DATA_VENDOR_REQUEST; |
| 621 | 620 | buf[1] = 0x08; |
| @@ -651,26 +650,25 @@ unlock: | ||
| 651 | 650 | return 0; /* no key pressed */ |
| 652 | 651 | |
| 653 | 652 | /* decoding */ |
| 654 | - b = buf+1; | |
| 655 | 653 | |
| 656 | 654 | #if 0 |
| 657 | 655 | deb_rc("RC: %d ", ret); |
| 658 | - debug_dump(b, ret, deb_rc); | |
| 656 | + debug_dump(buf + 1, ret, deb_rc); | |
| 659 | 657 | #endif |
| 660 | 658 | |
| 661 | 659 | ev.pulse = 0; |
| 662 | - while (1) { | |
| 663 | - ev.pulse = !ev.pulse; | |
| 664 | - ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000; | |
| 665 | - ir_raw_event_store(d->rc_dev, &ev); | |
| 666 | - | |
| 667 | - b++; | |
| 668 | - if (*b == 0xff) { | |
| 660 | + for (i = 1; i < ARRAY_SIZE(state->buf); i++) { | |
| 661 | + if (buf[i] == 0xff) { | |
| 669 | 662 | ev.pulse = 0; |
| 670 | 663 | ev.duration = 888888*2; |
| 671 | 664 | ir_raw_event_store(d->rc_dev, &ev); |
| 672 | 665 | break; |
| 673 | 666 | } |
| 667 | + | |
| 668 | + ev.pulse = !ev.pulse; | |
| 669 | + ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR * | |
| 670 | + FIRMWARE_CLOCK_TICK) / 1000; | |
| 671 | + ir_raw_event_store(d->rc_dev, &ev); | |
| 674 | 672 | } |
| 675 | 673 | |
| 676 | 674 | ir_raw_event_handle(d->rc_dev); |
Android-x86
Fork