AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-16 15:16:41 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
c1ced46c7b
linux_dsm_epyc7002/drivers/media/usb/pvrusb2
History
Dan Carpenter c1ced46c7b media: pvrusb2: Prevent a buffer overflow 
The ctrl_check_input() function is called from pvr2_ctrl_range_check().
It's supposed to validate user supplied input and return true or false
depending on whether the input is valid or not.  The problem is that
negative shifts or shifts greater than 31 are undefined in C.  In
practice with GCC they result in shift wrapping so this function returns
true for some inputs which are not valid and this could result in a
buffer overflow:

    drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname()
    warn: uncapped user index 'names[val]'

The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create()
and the highest valid bit is BIT(4).

Fixes: 7fb20fa38c ("V4L/DVB (7299): pvrusb2: Improve logic which handles input choice availability")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-04-22 11:45:08 -04:00
..
Kconfig media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
Makefile media: don't include drivers/media/i2c at cflags 2017-12-28 14:14:09 -05:00
pvrusb2-audio.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-audio.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-context.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-context.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-cs53l32a.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-cs53l32a.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-ctrl.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-ctrl.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-cx2584x-v4l.c media: pvrusb2: delete unneeded include 2018-05-09 16:28:19 -04:00
pvrusb2-cx2584x-v4l.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-debug.h media: pvrusb2: replace printk with pr_* 2018-10-09 08:07:48 -04:00
pvrusb2-debugifc.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-debugifc.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-devattr.c media: lgdt330x: convert it to the new I2C binding way 2018-05-04 11:09:26 -04:00
pvrusb2-devattr.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-dvb.c media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
pvrusb2-dvb.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
pvrusb2-eeprom.c [media] tveeprom: get rid of unused arg on tveeprom_hauppauge_analog() 2017-03-03 07:35:02 -03:00
pvrusb2-eeprom.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-encoder.c media: pvrusb2: fix the retry logic 2017-07-20 16:25:41 -04:00
pvrusb2-encoder.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-fx2-cmd.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-hdw-internal.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-hdw.c media: pvrusb2: Prevent a buffer overflow 2019-04-22 11:45:08 -04:00
pvrusb2-hdw.h media: pvrusb2: Prevent a buffer overflow 2019-04-22 11:45:08 -04:00
pvrusb2-i2c-core.c media: pvrusb2: replace printk with pr_* 2018-10-09 08:07:48 -04:00
pvrusb2-i2c-core.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-io.c [media] pvrusb2-io: Add some spaces for better code readability 2017-01-31 08:05:45 -02:00
pvrusb2-io.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-ioread.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-ioread.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-main.c media: pvrusb2: replace printk with pr_* 2018-10-09 08:07:48 -04:00
pvrusb2-std.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
pvrusb2-std.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-sysfs.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-sysfs.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-util.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-v4l2.c media: replace strncpy() by strscpy() 2019-03-29 10:26:13 -04:00
pvrusb2-v4l2.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-video-v4l.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-video-v4l.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-wm8775.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2-wm8775.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
pvrusb2.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00