media: mceusb: Fix potential out-of-bounds shift
authorJames Reynolds <jr@memlen.com>
Tue, 22 Dec 2020 12:07:04 +0000 (13:07 +0100)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 14 Jan 2021 12:45:38 +0000 (13:45 +0100)
commit1b43bad31fb0e00f45baf5b05bd21eb8d8ce7f58
treeec8cdc05192330df80c9f1b768ca7017de92c9ce
parent4487e0215560392bd11c9de08d60824d72c89cd9
media: mceusb: Fix potential out-of-bounds shift

When processing a MCE_RSP_GETPORTSTATUS command, the bit index to set in
ir->txports_cabled comes from response data, and isn't validated.

As ir->txports_cabled is a u8, nothing should be done if the bit index
is greater than 7.

Cc: stable@vger.kernel.org
Reported-by: syzbot+ec3b3128c576e109171d@syzkaller.appspotmail.com
Signed-off-by: James Reynolds <jr@memlen.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/rc/mceusb.c