Commit 72e637fe authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

media: rc: validate that "rc_proto" is reasonable 



Smatch complains that "rc_proto" comes from the user and it can result
in shift wrapping in ir_raw_encode_scancode()

    drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode()
    error: undefined (user controlled) shift '1 << protocol'

This is true, but I reviewed the surrounding code and it appears
harmless. Anyway, let's verify that "rc_proto" is valid as a kernel
hardening measure.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 7399139b

drivers/media/rc/lirc_dev.c

+2 −1
Original line number Diff line number Diff line
@@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf, 
			goto out_unlock;

		}



		if (scan.flags || scan.keycode || scan.timestamp) {

		if (scan.flags || scan.keycode || scan.timestamp ||

		    scan.rc_proto > RC_PROTO_MAX) {

			ret = -EINVAL;

			goto out_unlock;

		}

include/uapi/linux/lirc.h

+1 −0
Original line number Diff line number Diff line
@@ -226,6 +226,7 @@ enum rc_proto { 
	RC_PROTO_RCMM24		= 25,

	RC_PROTO_RCMM32		= 26,

	RC_PROTO_XBOX_DVD	= 27,

	RC_PROTO_MAX		= RC_PROTO_XBOX_DVD,

};



#endif