diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2020-10-30 12:52:30 +0100 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2020-11-17 06:57:10 +0100 |
| commit | 72e637fec558c7842d6f1508f480fd77c20afe3a (patch) | |
| tree | 0de9489d6a86cb822a8e054fc98c0b5e05b1fa25 /drivers/media/rc/lirc_dev.c | |
| parent | media: venus: core: add shutdown callback for venus (diff) | |
| download | linux-dev-72e637fec558c7842d6f1508f480fd77c20afe3a.tar.xz linux-dev-72e637fec558c7842d6f1508f480fd77c20afe3a.zip | |
media: rc: validate that "rc_proto" is reasonable
Smatch complains that "rc_proto" comes from the user and it can result
in shift wrapping in ir_raw_encode_scancode()
drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode()
error: undefined (user controlled) shift '1 << protocol'
This is true, but I reviewed the surrounding code and it appears
harmless. Anyway, let's verify that "rc_proto" is valid as a kernel
hardening measure.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media/rc/lirc_dev.c')
| -rw-r--r-- | drivers/media/rc/lirc_dev.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 220363b9a868..116daf90c858 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf, goto out_unlock; } - if (scan.flags || scan.keycode || scan.timestamp) { + if (scan.flags || scan.keycode || scan.timestamp || + scan.rc_proto > RC_PROTO_MAX) { ret = -EINVAL; goto out_unlock; } |