| From 3e45067f94bbd61dec0619b1c32744eb0de480c8 Mon Sep 17 00:00:00 2001 |
| From: Sean Young <sean@mess.org> |
| Date: Sun, 8 Oct 2017 14:18:52 -0400 |
| Subject: media: rc: check for integer overflow |
| |
| From: Sean Young <sean@mess.org> |
| |
| commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream. |
| |
| The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called |
| with a timeout of 4294968us. |
| |
| Signed-off-by: Sean Young <sean@mess.org> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/media/rc/ir-lirc-codec.c | 9 ++++++--- |
| 1 file changed, 6 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/media/rc/ir-lirc-codec.c |
| +++ b/drivers/media/rc/ir-lirc-codec.c |
| @@ -289,11 +289,14 @@ static long ir_lirc_ioctl(struct file *f |
| if (!dev->max_timeout) |
| return -ENOSYS; |
| |
| + /* Check for multiply overflow */ |
| + if (val > U32_MAX / 1000) |
| + return -EINVAL; |
| + |
| tmp = val * 1000; |
| |
| - if (tmp < dev->min_timeout || |
| - tmp > dev->max_timeout) |
| - return -EINVAL; |
| + if (tmp < dev->min_timeout || tmp > dev->max_timeout) |
| + return -EINVAL; |
| |
| dev->timeout = tmp; |
| break; |
