diff options
| author | Anton Vasilyev <vasilyev@ispras.ru> | 2018-07-18 10:13:56 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2018-08-02 18:53:42 -0400 |
| commit | 65b40a986fc68cb3b362bb855303b73a2b8538c2 (patch) | |
| tree | 53f19a19b6c6386c78677aee2a3b57345297d5d3 | |
| parent | media: helene: add I2C device probe function (diff) | |
| download | linux-65b40a986fc68cb3b362bb855303b73a2b8538c2.tar.gz linux-65b40a986fc68cb3b362bb855303b73a2b8538c2.zip | |
media: dm1105: Limit number of cards to avoid buffer over read
dm1105_probe() counts number of cards at dm1105_devcount,
but missed bounds check before dereference a card array.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
| -rw-r--r-- | drivers/media/pci/dm1105/dm1105.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c index c9db108751a7..1ddb0576fb7b 100644 --- a/drivers/media/pci/dm1105/dm1105.c +++ b/drivers/media/pci/dm1105/dm1105.c @@ -986,6 +986,9 @@ static int dm1105_probe(struct pci_dev *pdev, int ret = -ENOMEM; int i; + if (dm1105_devcount >= ARRAY_SIZE(card)) + return -ENODEV; + dev = kzalloc(sizeof(struct dm1105_dev), GFP_KERNEL); if (!dev) return -ENOMEM; |