From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Kees Cook" <keescook@chromium.org>, "Sean Young" <sean@mess.org>,
syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com,
"Mauro Carvalho Chehab" <mchehab+samsung@kernel.org>
Subject: [PATCH 3.16 18/25] media: technisat-usb2: break out of loop at end of buffer
Date: Tue, 12 Nov 2019 23:48:15 +0000 [thread overview]
Message-ID: <lsq.1573602477.954641686@decadent.org.uk> (raw)
In-Reply-To: <lsq.1573602477.548403712@decadent.org.uk>
3.16.77-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 0c4df39e504bf925ab666132ac3c98d6cbbe380b upstream.
Ensure we do not access the buffer beyond the end if no 0xff byte
is encountered.
Reported-by: syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
[bwh: Backported to 3.16: technisat_usb2_get_ir() still uses a stack
buffer, which is not worth fixing on this branch]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/usb/dvb-usb/technisat-usb2.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -591,9 +591,9 @@ static int technisat_usb2_frontend_attac
static int technisat_usb2_get_ir(struct dvb_usb_device *d)
{
- u8 buf[62], *b;
- int ret;
struct ir_raw_event ev;
+ u8 buf[62];
+ int i, ret;
buf[0] = GET_IR_DATA_VENDOR_REQUEST;
buf[1] = 0x08;
@@ -629,26 +629,25 @@ unlock:
return 0; /* no key pressed */
/* decoding */
- b = buf+1;
#if 0
deb_rc("RC: %d ", ret);
- debug_dump(b, ret, deb_rc);
+ debug_dump(buf + 1, ret, deb_rc);
#endif
ev.pulse = 0;
- while (1) {
- ev.pulse = !ev.pulse;
- ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000;
- ir_raw_event_store(d->rc_dev, &ev);
-
- b++;
- if (*b == 0xff) {
+ for (i = 1; i < ARRAY_SIZE(buf); i++) {
+ if (buf[i] == 0xff) {
ev.pulse = 0;
ev.duration = 888888*2;
ir_raw_event_store(d->rc_dev, &ev);
break;
}
+
+ ev.pulse = !ev.pulse;
+ ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR *
+ FIRMWARE_CLOCK_TICK) / 1000;
+ ir_raw_event_store(d->rc_dev, &ev);
}
ir_raw_event_handle(d->rc_dev);
next prev parent reply other threads:[~2019-11-12 23:51 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-12 23:47 [PATCH 3.16 00/25] 3.16.77-rc1 review Ben Hutchings
2019-11-12 23:47 ` [PATCH 3.16 01/25] KVM: Introduce kvm_get_arch_capabilities() Ben Hutchings
2019-11-12 23:47 ` [PATCH 3.16 02/25] KVM: x86: use Intel speculation bugs and features as derived in generic x86 code Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 03/25] x86/msr: Add the IA32_TSX_CTRL MSR Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 04/25] x86/cpu: Add a helper function x86_read_arch_cap_msr() Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 05/25] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 06/25] x86/speculation/taa: Add mitigation for TSX Async Abort Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 07/25] x86/speculation/taa: Add sysfs reporting " Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 08/25] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 09/25] x86/tsx: Add "auto" option to the tsx= cmdline parameter Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 10/25] x86/speculation/taa: Add documentation for TSX Async Abort Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 11/25] x86/tsx: Add config options to set tsx=on|off|auto Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 12/25] x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 13/25] x86/bugs: Add ITLB_MULTIHIT bug infrastructure Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 14/25] drm/i915/gen8+: Add RC6 CTX corruption WA Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 15/25] net: netem: fix error path for corrupted GSO frames Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 16/25] ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 17/25] media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap Ben Hutchings
2019-11-12 23:48 ` Ben Hutchings [this message]
2019-11-12 23:48 ` [PATCH 3.16 19/25] ax25: enforce CAP_NET_RAW for raw sockets Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 20/25] ieee802154: " Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 21/25] appletalk: " Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 22/25] mISDN: " Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 23/25] nfc: " Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 24/25] cfg80211: wext: avoid copying malformed SSIDs Ben Hutchings
2019-11-12 23:48 ` [PATCH 3.16 25/25] rtlwifi: Fix potential overflow on P2P code Ben Hutchings
2019-11-13 18:13 ` [PATCH 3.16 00/25] 3.16.77-rc1 review Guenter Roeck
2019-11-13 18:31 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1573602477.954641686@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=kda@linux-powerpc.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=sean@mess.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox