3.14-stable patches

added patches:
	media-ttusb-dec-buffer-overflow-in-ioctl.patch

diff --git a/queue-3.14/media-ttusb-dec-buffer-overflow-in-ioctl.patch b/queue-3.14/media-ttusb-dec-buffer-overflow-in-ioctl.patch
new file mode 100644 (file)
index 0000000..b8586c3
--- /dev/null
+++ b/queue-3.14/media-ttusb-dec-buffer-overflow-in-ioctl.patch
@@ -0,0 +1,31 @@
+From f2e323ec96077642d397bb1c355def536d489d16 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 5 Sep 2014 09:09:28 -0300
+Subject: media: ttusb-dec: buffer overflow in ioctl
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f2e323ec96077642d397bb1c355def536d489d16 upstream.
+
+We need to add a limit check here so we don't overflow the buffer.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/ttusb-dec/ttusbdecfe.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c
++++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c
+@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_m
+                  0x00, 0x00, 0x00, 0x00,
+                  0x00, 0x00 };
+ 
++      if (cmd->msg_len > sizeof(b) - 4)
++              return -EINVAL;
++
+       memcpy(&b[4], cmd->msg, cmd->msg_len);
+ 
+       state->config->send_command(fe, 0x72,

diff --git a/queue-3.14/series b/queue-3.14/series
index e0529d3bc540e0b0db9569902ddc6445984f3427..aca6bc6094d931bdb55741ac95b6e86599eee04f 100644 (file)
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -70,3 +70,4 @@ nfs-don-t-try-to-reclaim-delegation-open-state-if-recovery-failed.patch
 nfs-fix-use-of-uninitialized-variable-in-nfs_getattr.patch
 nfsv4-fix-races-between-nfs_remove_bad_delegation-and-delegation-return.patch
 nfsv4.1-nfs41_clear_delegation_stateid-shouldn-t-trust-nfs_delegated_state.patch
+media-ttusb-dec-buffer-overflow-in-ioctl.patch