p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[media] cec-adap: prevent write to out-of-bounds array index 

CEC_MSG_REPORT_PHYSICAL_ADDR can theoretically be received from
an unregistered device, but in that case the code should not attempt
to write the received physical address to the phys_addrs array.

That would be pointless since there can be multiple unregistered
devices that report a physical address. We just ignore those.

While at it, improve the dprintk since it would attempt to read
from that array as well with the same out-of-bounds problem.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Hans Verkuil 2016-06-30 07:08:53 -03:00 committed by Mauro Carvalho Chehab
parent 12655445a2
commit f8db65fe43
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/staging/media/cec/cec-adap.c
View File

@ -1442,12 +1442,15 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
switch (msg->msg[1]) {
/* The following messages are processed but still passed through */
case CEC_MSG_REPORT_PHYSICAL_ADDR:
adap->phys_addrs[init_laddr] =
(msg->msg[2] << 8) | msg->msg[3];
dprintk(1, "Reported physical address %04x for logical address %d\n",
adap->phys_addrs[init_laddr], init_laddr);
case CEC_MSG_REPORT_PHYSICAL_ADDR: {
u16 pa = (msg->msg[2] << 8) | msg->msg[3];
if (!from_unregistered)
adap->phys_addrs[init_laddr] = pa;
dprintk(1, "Reported physical address %x.%x.%x.%x for logical address %d\n",
cec_phys_addr_exp(pa), init_laddr);
break;
}
case CEC_MSG_USER_CONTROL_PRESSED:
if (!(adap->capabilities & CEC_CAP_RC))