linux/drivers/media
Dan Carpenter 9c2ccc324b media: wl128x: prevent two potential buffer overflows
Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
can copy up to 255 bytes and we only have room for two bytes.  Even
if this comes from the firmware and we trust it, the new policy
generally is just to fix it as kernel hardenning.

I can't test this code so I tried to be very conservative.  I considered
not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
whole variable but in the end I decided to allow it and manually
initialized "asic_id" and "asic_ver" to zero.

Fixes: e8454ff7b9 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-03-29 07:43:48 -04:00
..
cec media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
common media: cx2341x: replace badly designed macros 2019-03-25 18:02:25 -04:00
dvb-core media: dvbdev: remove double-unlock 2019-03-28 14:36:14 -04:00
dvb-frontends media: si2165: fix a missing check of return value 2019-03-19 16:47:20 -04:00
firewire media: firewire: Fix app_info parameter type in avc_ca{,_app}_info 2018-12-05 05:34:33 -05:00
i2c media: i2c: tda1997x: select V4L2_FWNODE 2019-03-29 07:38:50 -04:00
mmc media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
pci media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame 2019-03-29 07:43:17 -04:00
platform media: video-mux: fix null pointer dereferences 2019-03-29 07:42:37 -04:00
radio media: wl128x: prevent two potential buffer overflows 2019-03-29 07:43:48 -04:00
rc media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
spi media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
tuners media: tuners: fix several typos 2019-03-01 09:40:29 -05:00
usb media: usbvision: fix a potential NULL pointer dereference 2019-03-29 07:42:56 -04:00
v4l2-core media: v4l2-ctrl: potential shift wrapping bugs 2019-03-29 07:40:45 -04:00
Kconfig media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
Makefile media: media-request: implement media requests 2018-08-31 11:04:51 -04:00
media-device.c media: Add a Kconfig option for the Request API 2018-12-05 13:07:43 -05:00
media-devnode.c media: media-devnode: fill in media chardev kobject to ease debugging 2019-03-19 13:21:16 -04:00
media-entity.c media: replace WARN_ON in __media_pipeline_start() 2019-03-19 14:01:08 -04:00
media-request.c media: media requests: return EBADR instead of EACCES 2019-03-25 13:26:10 -04:00