From: Daniel Scheller <d.scheller.oss@gmail.com>
To: linux-media@vger.kernel.org, mchehab@kernel.org,
mchehab@s-opensource.com
Cc: jasmin@anw.at, d_spingler@gmx.de, rjkm@metzlerbros.de
Subject: [PATCH 3/4] [media] ddbridge: fix buffer overflow in max_set_input_unlocked()
Date: Sun, 9 Jul 2017 21:42:45 +0200 [thread overview]
Message-ID: <20170709194246.10334-4-d.scheller.oss@gmail.com> (raw)
In-Reply-To: <20170709194246.10334-1-d.scheller.oss@gmail.com>
From: Daniel Scheller <d.scheller@gmx.net>
Picked up code parts introduced one smatch error:
drivers/media/pci/ddbridge/ddbridge-maxs8.c:163 max_set_input_unlocked() error: buffer overflow 'dev->link[port->lnr].lnb.voltage' 4 <= 255
Fix this by clamping the .lnb.voltage array access to 0-3 by "& 3"'ing
dvb->input.
Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
---
drivers/media/pci/ddbridge/ddbridge-maxs8.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/pci/ddbridge/ddbridge-maxs8.c b/drivers/media/pci/ddbridge/ddbridge-maxs8.c
index a9dc5f9754da..10716ee8cf59 100644
--- a/drivers/media/pci/ddbridge/ddbridge-maxs8.c
+++ b/drivers/media/pci/ddbridge/ddbridge-maxs8.c
@@ -187,11 +187,12 @@ static int max_set_input_unlocked(struct dvb_frontend *fe, int in)
return -EINVAL;
if (dvb->input != in) {
u32 bit = (1ULL << input->nr);
- u32 obit = dev->link[port->lnr].lnb.voltage[dvb->input] & bit;
+ u32 obit =
+ dev->link[port->lnr].lnb.voltage[dvb->input & 3] & bit;
- dev->link[port->lnr].lnb.voltage[dvb->input] &= ~bit;
+ dev->link[port->lnr].lnb.voltage[dvb->input & 3] &= ~bit;
dvb->input = in;
- dev->link[port->lnr].lnb.voltage[dvb->input] |= obit;
+ dev->link[port->lnr].lnb.voltage[dvb->input & 3] |= obit;
}
res = dvb->set_input(fe, in);
return res;
--
2.13.0
next prev parent reply other threads:[~2017-07-09 19:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-09 19:42 [PATCH 0/4] MxL5xx demodulator-tuner driver, DD MaxS8 support Daniel Scheller
2017-07-09 19:42 ` [PATCH 1/4] [media] dvb-frontends: MaxLinear MxL5xx DVB-S/S2 tuner-demodulator driver Daniel Scheller
2017-07-10 8:41 ` Ralph Metzler
2017-07-10 15:40 ` Daniel Scheller
2017-07-09 19:42 ` [PATCH 2/4] [media] ddbridge: support MaxLinear MXL5xx based cards (MaxS4/8) Daniel Scheller
2017-07-09 19:42 ` Daniel Scheller [this message]
2017-07-10 8:12 ` [PATCH 3/4] [media] ddbridge: fix buffer overflow in max_set_input_unlocked() Ralph Metzler
2017-07-10 15:43 ` Daniel Scheller
2017-07-09 19:42 ` [PATCH 4/4] [media] MAINTAINERS: add entry for mxl5xx Daniel Scheller
2017-08-20 11:15 ` [PATCH 0/4] MxL5xx demodulator-tuner driver, DD MaxS8 support Daniel Scheller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170709194246.10334-4-d.scheller.oss@gmail.com \
--to=d.scheller.oss@gmail.com \
--cc=d_spingler@gmx.de \
--cc=jasmin@anw.at \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=mchehab@s-opensource.com \
--cc=rjkm@metzlerbros.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.