Commit a828d72d authored Sep 29, 2015 by Laura Abbott Committed by Mauro Carvalho Chehab Oct 22, 2015

[media] si2157: Bounds check firmware



When reading the firmware and sending commands, the length
must be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the
expected format. Add the proper check.

Cc: stable@kernel.org
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

parent 54bec397

drivers/media/tuners/si2157.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe)

		for (remaining = fw->size; remaining > 0; remaining -= 17) {
		len = fw->data[fw->size - remaining];
		if (len > SI2157_ARGLEN) {
		dev_err(&client->dev, "Bad firmware length\n");
		goto err_release_firmware;
		}
		memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
		cmd.wlen = len;
		cmd.rlen = 1;