Commit 47810b43 authored by Laura Abbott's avatar Laura Abbott Committed by Mauro Carvalho Chehab

[media] si2168: Bounds check firmware

When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:

si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f

Add the proper check.

Cc: stable@kernel.org
Reported-by: default avatarStuart Auchterlonie <sauchter@redhat.com>
Reviewed-by: default avatarAntti Palosaari <crope@iki.fi>
Signed-off-by: default avatarLaura Abbott <labbott@fedoraproject.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent a828d72d
...@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe) ...@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe)
/* firmware is in the new format */ /* firmware is in the new format */
for (remaining = fw->size; remaining > 0; remaining -= 17) { for (remaining = fw->size; remaining > 0; remaining -= 17) {
len = fw->data[fw->size - remaining]; len = fw->data[fw->size - remaining];
if (len > SI2168_ARGLEN) {
ret = -EINVAL;
break;
}
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
cmd.wlen = len; cmd.wlen = len;
cmd.rlen = 1; cmd.rlen = 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment