[PATCH] media: dvb_ca_en50221: sanity check slot number from userspace

From	Colin King <colin.king@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH] media: dvb_ca_en50221: sanity check slot number from userspace
Date	2017-09-21 00:30 +0200
Message-ID	<urVFf-FH-5@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Colin Ian King <colin.king@canonical.com>

Currently a user can pass in an unsanitized slot number which
will lead to and out of range index into ca->slot_info. Fix this
by checking that the slot number is no more than the allowed
maximum number of slots. Seems that this bug has been in the driver
forever.

Detected by CoverityScan, CID#139381 ("Untrusted pointer read")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/media/dvb-core/dvb_ca_en50221.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index 95b3723282f4..e3a92b529dba 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -1474,6 +1474,9 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
 		return -EFAULT;
 	buf += 2;
 	count -= 2;
+
+	if (slot >= ca->slot_count)
+		return -EINVAL;
 	sl = &ca->slot_info[slot];
 
 	/* check if the slot is actually running */
-- 
2.14.1

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] media: dvb_ca_en50221: sanity check slot number from userspace Colin King <colin.king@canonical.com> - 2017-09-21 00:30 +0200
  Re: [PATCH] media: dvb_ca_en50221: sanity check slot number from  userspace Dan Carpenter <dan.carpenter@oracle.com> - 2017-09-21 02:00 +0200

csiph-web