korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-02 00:24:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

media: rc: validate that "rc_proto" is reasonable

Browse Source 
Smatch complains that "rc_proto" comes from the user and it can result
in shift wrapping in ir_raw_encode_scancode()

    drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode()
    error: undefined (user controlled) shift '1 << protocol'

This is true, but I reviewed the surrounding code and it appears
harmless. Anyway, let's verify that "rc_proto" is valid as a kernel
hardening measure.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Dan Carpenter 2020-10-30 12:52:30 +01:00 committed by Mauro Carvalho Chehab
parent 7399139be6
commit 72e637fec5
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/media/rc/lirc_dev.c
View File

@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf,
goto out_unlock;
}
if (scan.flags || scan.keycode || scan.timestamp) {
if (scan.flags || scan.keycode || scan.timestamp ||
scan.rc_proto > RC_PROTO_MAX) {
ret = -EINVAL;
goto out_unlock;
}

1
include/uapi/linux/lirc.h
View File

@ -226,6 +226,7 @@ enum rc_proto {
RC_PROTO_RCMM24 = 25,
RC_PROTO_RCMM32 = 26,
RC_PROTO_XBOX_DVD = 27,
RC_PROTO_MAX = RC_PROTO_XBOX_DVD,
};
#endif