Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1ffdc298 authored by Sean Young's avatar Sean Young Committed by Greg Kroah-Hartman
Browse files

media: mceusb: sanity check for prescaler value 



commit 9dec0f48a75e0dadca498002d25ef4e143e60194 upstream.

prescaler larger than 8 would mean the carrier is at most 152Hz,
which does not make sense for IR carriers.

Reported-by: default avatar <syzbot+6d31bf169a8265204b8d@syzkaller.appspotmail.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 26c080b9

drivers/media/rc/mceusb.c

+8 −1
Original line number Diff line number Diff line
@@ -685,11 +685,18 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len, 
				data[0], data[1]);

			break;

		case MCE_RSP_EQIRCFS:

			if (!data[0] && !data[1]) {

				dev_dbg(dev, "%s: no carrier", inout);

				break;

			}

			// prescaler should make sense

			if (data[0] > 8)

				break;

			period = DIV_ROUND_CLOSEST((1U << data[0] * 2) *

						   (data[1] + 1), 10);

			if (!period)

				break;

			carrier = (1000 * 1000) / period;

			carrier = USEC_PER_SEC / period;

			dev_dbg(dev, "%s carrier of %u Hz (period %uus)",

				 inout, carrier, period);

			break;