From patchwork Fri Jan 7 13:46:51 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 5480 Return-path: Envelope-to: mchehab@pedra Delivery-date: Sun, 09 Jan 2011 17:01:48 -0200 Received: from mchehab by pedra with local (Exim 4.72) (envelope-from ) id 1Pc0WR-00011E-WF for mchehab@pedra; Sun, 09 Jan 2011 17:01:48 -0200 Received: from casper.infradead.org [85.118.1.10] by pedra with IMAP (fetchmail-6.3.17) for (single-drop); Sun, 09 Jan 2011 17:01:47 -0200 (BRST) Received: from vger.kernel.org ([209.132.180.67]) by casper.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux)) id 1PbCfQ-0006To-AU; Fri, 07 Jan 2011 13:47:44 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751772Ab1AGNrl (ORCPT + 1 other); Fri, 7 Jan 2011 08:47:41 -0500 Received: from mail-gy0-f174.google.com ([209.85.160.174]:56015 "EHLO mail-gy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751371Ab1AGNrk (ORCPT ); Fri, 7 Jan 2011 08:47:40 -0500 Received: by gyb11 with SMTP id 11so6558568gyb.19 for ; Fri, 07 Jan 2011 05:47:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=FafjrAnQe6tu5s04Lk1mhRH0ipTfLMJc31bdmqBjuZo=; b=X15cCtNL5EXlyu5pvbwjUrBp9m39LX6pMFx+lsmUjB3CD2ZO7DPRrg8ji76iQ+rFYp OyMAbHauv869bqyloxha7u6j02zyDHR3rboJZk5padSydse0QcR0iTWgb8jBpKnucgLO cdsOrW7c3DzmiXyvtXgusB0csmOZ1JzoAzLoE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; b=dWHKfFaiN7yNvnFykgw8CdbMWWptOmx7Fj2omWzloYAG2Tb/Cbc5MiVbKawN1MlM/L GMyFvbJJByiFK8ZQWNtexxhkkv/s/T+pS5UJnt7G0qHqYG5M+Sc7Z/v6jI+xoHNMQVLC uqqpC1gFnUVdbzfI4rOnwRGz/24xtOdsLTprM= Received: by 10.91.66.18 with SMTP id t18mr3256498agk.191.1294408059632; Fri, 07 Jan 2011 05:47:39 -0800 (PST) Received: from bicker (h14ba.n2.ips.mtn.co.ug [212.88.116.186]) by mx.google.com with ESMTPS id t1sm33582593ano.3.2011.01.07.05.47.23 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 07 Jan 2011 05:47:38 -0800 (PST) Date: Fri, 7 Jan 2011 16:46:51 +0300 From: Dan Carpenter To: Andreas Oberritter Cc: Mauro Carvalho Chehab , linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch v2] [media] av7110: check for negative array offset Message-ID: <20110107134651.GH1717@bicker> References: <20110106194059.GC1717@bicker> <4D270A9F.7080104@linuxtv.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <4D270A9F.7080104@linuxtv.org> User-Agent: Mutt/1.5.20 (2009-06-14) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Sender: info->num comes from the user. It's type int. If the user passes in a negative value that would cause memory corruption. Signed-off-by: Dan Carpenter --- V2: change the check instead of making num and unsigned int -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c index 122c728..923a8e2 100644 --- a/drivers/media/dvb/ttpci/av7110_ca.c +++ b/drivers/media/dvb/ttpci/av7110_ca.c @@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) { ca_slot_info_t *info=(ca_slot_info_t *)parg; - if (info->num > 1) + if ((unsigned)info->num > 1) return -EINVAL; av7110->ci_slot[info->num].num = info->num; av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?