Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25379bf8 authored by Sean Young's avatar Sean Young Committed by Mauro Carvalho Chehab
Browse files

[media] lirc: validate transmission ir data 



The lirc interface allows 255 u32 spaces and pulses, which are usec. If
the driver can handle this (e.g. winbond-cir) you can produce hours of
meaningless IR data and there is no method of interrupting it.

Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent 58a61f99

drivers/media/rc/ir-lirc-codec.c

+10 −1
Original line number Diff line number Diff line
@@ -140,11 +140,20 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf, 
		goto out;

	}



	for (i = 0; i < count; i++) {

		if (txbuf[i] > IR_MAX_DURATION / 1000 - duration || !txbuf[i]) {

			ret = -EINVAL;

			goto out;

		}



		duration += txbuf[i];

	}



	ret = dev->tx_ir(dev, txbuf, count);

	if (ret < 0)

		goto out;



	for (i = 0; i < ret; i++)

	for (duration = i = 0; i < ret; i++)

		duration += txbuf[i];



	ret *= sizeof(unsigned int);