From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Dan Carpenter" <dan.carpenter@oracle.com>,
"Mauro Carvalho Chehab" <mchehab@osg.samsung.com>
Subject: [PATCH 3.2 11/27] [media] ttusb-dec: buffer overflow in ioctl
Date: Mon, 29 Dec 2014 02:11:31 +0100 [thread overview]
Message-ID: <lsq.1419815491.744659422@decadent.org.uk> (raw)
In-Reply-To: <lsq.1419815490.288081487@decadent.org.uk>
3.2.66-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit f2e323ec96077642d397bb1c355def536d489d16 upstream.
We need to add a limit check here so we don't overflow the buffer.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/dvb/ttusb-dec/ttusbdecfe.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
+++ b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
@@ -154,6 +154,9 @@ static int ttusbdecfe_dvbs_diseqc_send_m
0x00, 0x00, 0x00, 0x00,
0x00, 0x00 };
+ if (cmd->msg_len > sizeof(b) - 4)
+ return -EINVAL;
+
memcpy(&b[4], cmd->msg, cmd->msg_len);
state->config->send_command(fe, 0x72,
next prev parent reply other threads:[~2014-12-29 1:12 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-29 1:11 [PATCH 3.2 00/27] 3.2.66-rc1 review Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 04/27] mm: fix swapoff hang after page migration and fork Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 01/27] drm/i915: Unlock panel even when LVDS is disabled Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 18/27] crypto: ghash-clmulni-intel - use C implementation for setkey() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 27/27] x86: kvm: use alternatives for VMCALL vs. VMMCALL if kernel text is read-only Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 26/27] net: sctp: use MAX_HEADER for headroom reserve in output path Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 06/27] i2c: davinci: generate STP always when NACK is received Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 05/27] ahci: disable MSI on SAMSUNG 0xa800 SSD Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 09/27] KVM: x86: Don't report guest userspace emulation error to userspace Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 17/27] drm: fix DRM_IOCTL_MODE_GETFB handle-leak Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 19/27] drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 07/27] udf: Avoid infinite loop when processing indirect ICBs Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 23/27] tcp: md5: do not use alloc_percpu() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 14/27] deal with deadlock in d_walk() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 12/27] x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit Ben Hutchings
2014-12-29 1:11 ` Ben Hutchings [this message]
2014-12-29 1:11 ` [PATCH 3.2 02/27] AHCI: Add DeviceIDs for Sunrise Point-LP SATA controller Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 16/27] s390,time: revert direct ktime path for s390 clockevent device Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 10/27] x86/tls: Validate TLS entries to protect espfix Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 21/27] ipv4: fix nexthop attlen check in fib_nh_match Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 15/27] ext4: make orphan functions be no-op in no-journal mode Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 20/27] net: sctp: fix memory leak in auth key management Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 08/27] net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 13/27] move d_rcu from overlapping d_child to overlapping d_alias Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 22/27] tcp: md5: remove spinlock usage in fast path Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 24/27] ipv4: dst_entry leak in ip_send_unicast_reply() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 25/27] drivers/net: macvtap and tun depend on INET Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 03/27] sata_fsl: fix error handling of irq_of_parse_and_map Ben Hutchings
2014-12-29 1:14 ` [PATCH 3.2 00/27] 3.2.66-rc1 review Ben Hutchings
2014-12-29 9:39 ` Guenter Roeck
2014-12-29 11:28 ` Ben Hutchings
2014-12-30 0:26 ` Satoru Takeuchi
2014-12-30 1:56 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1419815491.744659422@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®