leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
9c2ccc324b
linux/drivers/media/radio
History
Dan Carpenter 9c2ccc324b media: wl128x: prevent two potential buffer overflows 
Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
can copy up to 255 bytes and we only have room for two bytes.  Even
if this comes from the firmware and we trust it, the new policy
generally is just to fix it as kernel hardenning.

I can't test this code so I tried to be very conservative.  I considered
not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
whole variable but in the end I decided to allow it and manually
initialized "asic_id" and "asic_ver" to zero.

Fixes: e8454ff7b9 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-03-29 07:43:48 -04:00
..
si470x media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
si4713 media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
wl128x media: wl128x: prevent two potential buffer overflows 2019-03-29 07:43:48 -04:00
dsbr100.c media: replace strcpy() by strscpy() 2018-09-11 13:32:17 -04:00
Kconfig media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
lm7000.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
radio-aimslab.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-aztech.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-cadet.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-gemtek.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-isa.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-isa.h
radio-keene.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-ma901.c media: replace strcpy() by strscpy() 2018-09-11 13:32:17 -04:00
radio-maxiradio.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-miropcm20.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-mr800.c media: replace strcpy() by strscpy() 2018-09-11 13:32:17 -04:00
radio-raremono.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-rtrack2.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-sf16fmi.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-sf16fmr2.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-shark2.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-shark.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-si476x.c media: radio: fix several typos 2019-03-01 09:26:50 -05:00
radio-tea5764.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-tea5777.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-tea5777.h
radio-terratec.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-timb.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-trust.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-typhoon.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
radio-wl1273.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
radio-zoltrix.c MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
saa7706h.c
tea575x.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
tef6862.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00