media: mceusb: Fix potential out-of-bounds shift
authorJames Reynolds <jr@memlen.com>
Tue, 22 Dec 2020 12:07:04 +0000 (13:07 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Mar 2021 10:38:23 +0000 (11:38 +0100)
commit0fe6ea18f2bb8676837b59a74c70c0391ede9f76
tree51d045776ad43d8d5b3e6bd48aee572237b37358
parent960652adc54ab9a3830946d6b6c8f11caf3fa25c
media: mceusb: Fix potential out-of-bounds shift

commit 1b43bad31fb0e00f45baf5b05bd21eb8d8ce7f58 upstream.

When processing a MCE_RSP_GETPORTSTATUS command, the bit index to set in
ir->txports_cabled comes from response data, and isn't validated.

As ir->txports_cabled is a u8, nothing should be done if the bit index
is greater than 7.

Cc: stable@vger.kernel.org
Reported-by: syzbot+ec3b3128c576e109171d@syzkaller.appspotmail.com
Signed-off-by: James Reynolds <jr@memlen.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/rc/mceusb.c