From a24e6348e5a0e8562ad64d760c25907ed088611c Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Wed, 20 Sep 2017 18:19:59 -0400 Subject: [PATCH] media: dvb_ca_en50221: sanity check slot number from userspace Currently a user can pass in an unsanitized slot number which will lead to and out of range index into ca->slot_info. Fix this by checking that the slot number is no more than the allowed maximum number of slots. Seems that this bug has been in the driver forever. Detected by CoverityScan, CID#139381 ("Untrusted pointer read") Signed-off-by: Colin Ian King Reviewed-by: Dan Carpenter Reviewed-by: Jasmin Jessich Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_ca_en50221.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index d48b61e..a3b2754 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -1473,6 +1473,9 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file, return -EFAULT; buf += 2; count -= 2; + + if (slot >= ca->slot_count) + return -EINVAL; sl = &ca->slot_info[slot]; /* check if the slot is actually running */ -- 2.7.4