Commit a828d72d authored by Laura Abbott's avatar Laura Abbott Committed by Mauro Carvalho Chehab

[media] si2157: Bounds check firmware

When reading the firmware and sending commands, the length
must be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the
expected format. Add the proper check.

Cc: stable@kernel.org
Signed-off-by: default avatarLaura Abbott <labbott@fedoraproject.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 54bec397
...@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe) ...@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe)
for (remaining = fw->size; remaining > 0; remaining -= 17) { for (remaining = fw->size; remaining > 0; remaining -= 17) {
len = fw->data[fw->size - remaining]; len = fw->data[fw->size - remaining];
if (len > SI2157_ARGLEN) {
dev_err(&client->dev, "Bad firmware length\n");
goto err_release_firmware;
}
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
cmd.wlen = len; cmd.wlen = len;
cmd.rlen = 1; cmd.rlen = 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment