* [PATCH] media: mceusb: Fix potential out-of-bounds shift
@ 2020-12-22 12:07 James Reynolds
2020-12-22 13:05 ` Sean Young
0 siblings, 1 reply; 2+ messages in thread
From: James Reynolds @ 2020-12-22 12:07 UTC (permalink / raw)
To: sean; +Cc: linux-media, stable, syzbot+ec3b3128c576e109171d
When processing a MCE_RSP_GETPORTSTATUS command, the bit index to set in
ir->txports_cabled comes from response data, and isn't validated.
As ir->txports_cabled is a u8, nothing should be done if the bit index
is greater than 7.
Cc: stable@vger.kernel.org
Reported-by: syzbot+ec3b3128c576e109171d@syzkaller.appspotmail.com
Signed-off-by: James Reynolds <jr@memlen.com>
---
drivers/media/rc/mceusb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index f1dbd059ed08..c8d63673e131 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1169,7 +1169,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, u8 *buf_in)
switch (subcmd) {
/* the one and only 5-byte return value command */
case MCE_RSP_GETPORTSTATUS:
- if (buf_in[5] == 0)
+ if (buf_in[5] == 0 && *hi < 8)
ir->txports_cabled |= 1 << *hi;
break;
--
2.29.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] media: mceusb: Fix potential out-of-bounds shift
2020-12-22 12:07 [PATCH] media: mceusb: Fix potential out-of-bounds shift James Reynolds
@ 2020-12-22 13:05 ` Sean Young
0 siblings, 0 replies; 2+ messages in thread
From: Sean Young @ 2020-12-22 13:05 UTC (permalink / raw)
To: James Reynolds; +Cc: linux-media, stable, syzbot+ec3b3128c576e109171d
On Tue, Dec 22, 2020 at 12:07:04PM +0000, James Reynolds wrote:
> When processing a MCE_RSP_GETPORTSTATUS command, the bit index to set in
> ir->txports_cabled comes from response data, and isn't validated.
>
> As ir->txports_cabled is a u8, nothing should be done if the bit index
> is greater than 7.
>
> Cc: stable@vger.kernel.org
> Reported-by: syzbot+ec3b3128c576e109171d@syzkaller.appspotmail.com
> Signed-off-by: James Reynolds <jr@memlen.com>
> ---
> drivers/media/rc/mceusb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
> index f1dbd059ed08..c8d63673e131 100644
> --- a/drivers/media/rc/mceusb.c
> +++ b/drivers/media/rc/mceusb.c
> @@ -1169,7 +1169,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, u8 *buf_in)
> switch (subcmd) {
> /* the one and only 5-byte return value command */
> case MCE_RSP_GETPORTSTATUS:
> - if (buf_in[5] == 0)
> + if (buf_in[5] == 0 && *hi < 8)
> ir->txports_cabled |= 1 << *hi;
So *hi is a port number. I don't know of any devices that have more than
2 ports, so this is fine.
Reviewed-by: Sean Young <sean@mess.org>
Thanks
Sean
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-12-22 13:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-22 12:07 [PATCH] media: mceusb: Fix potential out-of-bounds shift James Reynolds
2020-12-22 13:05 ` Sean Young
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.