diff mbox

media: dvb_ca_en50221: sanity check slot number from userspace

Message ID 20170920221959.5979-1-colin.king@canonical.com (mailing list archive)
State New, archived
Headers show

Commit Message

Colin King Sept. 20, 2017, 10:19 p.m. UTC 
From: Colin Ian King <colin.king@canonical.com>

Currently a user can pass in an unsanitized slot number which
will lead to and out of range index into ca->slot_info. Fix this
by checking that the slot number is no more than the allowed
maximum number of slots. Seems that this bug has been in the driver
forever.

Detected by CoverityScan, CID#139381 ("Untrusted pointer read")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/media/dvb-core/dvb_ca_en50221.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Dan Carpenter Sept. 20, 2017, 11:49 p.m. UTC | #1 
Looks good.

Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>

regards,
dan carpenter
Jasmin J. Oct. 15, 2017, 1:51 p.m. UTC | #2 
Good catch!

> Seems that this bug has been in the driver forever.
Indeed ... and I overlooked it during my recent changes to that module.

Reviewed-by: Jasmin Jessich <jasmin@anw.at>

BR,
   Jasmin
diff mbox

Patch

diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index 95b3723282f4..e3a92b529dba 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -1474,6 +1474,9 @@  static ssize_t dvb_ca_en50221_io_write(struct file *file,
 		return -EFAULT;
 	buf += 2;
 	count -= 2;
+
+	if (slot >= ca->slot_count)
+		return -EINVAL;
 	sl = &ca->slot_info[slot];
 
 	/* check if the slot is actually running */