mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-23 02:54:32 +08:00
a24e6348e5
Currently a user can pass in an unsanitized slot number which
will lead to and out of range index into ca->slot_info. Fix this
by checking that the slot number is no more than the allowed
maximum number of slots. Seems that this bug has been in the driver
forever.
Detected by CoverityScan, CID#139381 ("Untrusted pointer read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jasmin Jessich <jasmin@anw.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
||
|---|---|---|
| .. | ||
| demux.h | ||
| dmxdev.c | ||
| dmxdev.h | ||
| dvb_ca_en50221.c | ||
| dvb_ca_en50221.h | ||
| dvb_demux.c | ||
| dvb_demux.h | ||
| dvb_frontend.c | ||
| dvb_frontend.h | ||
| dvb_math.c | ||
| dvb_math.h | ||
| dvb_net.c | ||
| dvb_net.h | ||
| dvb_ringbuffer.c | ||
| dvb_ringbuffer.h | ||
| dvb-usb-ids.h | ||
| dvbdev.c | ||
| dvbdev.h | ||
| Kconfig | ||
| Makefile | ||