Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2130184 authored by obar's avatar obar Committed by Gerrit - the friendly Code Review server
Browse files

tspp: Protect against buffer overflow 



Change filter->priority to unsigned int. Since it was defined as integer,
it may have had negative value and cause accessing an array outside
of its region

CRs-Fixed: 561802, 561825
Change-Id: Ie72aa09b07e79b0b67081b74e3b2057de30f03d0
Signed-off-by: default avatarOded Bar <obar@codeaurora.org>
parent c5f82809

drivers/media/platform/msm/broadcast/tspp.c

+5 −1
Original line number Diff line number Diff line
@@ -1827,7 +1827,7 @@ int tspp_add_filter(u32 dev, u32 channel_id, 
	}



	if (filter->priority >= TSPP_NUM_PRIORITIES) {

		pr_err("tspp invalid source");

		pr_err("tspp invalid filter priority");

		return -ENOSR;

	}
@@ -1956,6 +1956,10 @@ int tspp_remove_filter(u32 dev, u32 channel_id, 
		pr_err("tspp_remove: can't find device %i", dev);

		return -ENODEV;

	}

	if (filter->priority >= TSPP_NUM_PRIORITIES) {

		pr_err("tspp invalid filter priority");

		return -ENOSR;

	}

	channel = &pdev->channels[channel_id];



	src = channel->src;

include/uapi/linux/tspp.h

+1 −1
Original line number Diff line number Diff line
@@ -34,7 +34,7 @@ struct tspp_filter { 
	int pid;

	int mask;

	enum tspp_mode mode;

	int priority;	/* 0 - 15 */

	unsigned int priority;	/* 0 - 15 */

	int decrypt;

	enum tspp_source source;

};