From: Greg Kroah-Hartman Date: Tue, 18 Nov 2014 20:27:27 +0000 (-0800) Subject: 3.14-stable patches X-Git-Tag: v3.10.61~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=64ead4b4dd56f2efabbcc5c4a5f24f3cf5bce90f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: media-ttusb-dec-buffer-overflow-in-ioctl.patch --- diff --git a/queue-3.14/media-ttusb-dec-buffer-overflow-in-ioctl.patch b/queue-3.14/media-ttusb-dec-buffer-overflow-in-ioctl.patch new file mode 100644 index 00000000000..b8586c3eefe --- /dev/null +++ b/queue-3.14/media-ttusb-dec-buffer-overflow-in-ioctl.patch @@ -0,0 +1,31 @@ +From f2e323ec96077642d397bb1c355def536d489d16 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 5 Sep 2014 09:09:28 -0300 +Subject: media: ttusb-dec: buffer overflow in ioctl + +From: Dan Carpenter + +commit f2e323ec96077642d397bb1c355def536d489d16 upstream. + +We need to add a limit check here so we don't overflow the buffer. + +Signed-off-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/ttusb-dec/ttusbdecfe.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c ++++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c +@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_m + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00 }; + ++ if (cmd->msg_len > sizeof(b) - 4) ++ return -EINVAL; ++ + memcpy(&b[4], cmd->msg, cmd->msg_len); + + state->config->send_command(fe, 0x72, diff --git a/queue-3.14/series b/queue-3.14/series index e0529d3bc54..aca6bc6094d 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -70,3 +70,4 @@ nfs-don-t-try-to-reclaim-delegation-open-state-if-recovery-failed.patch nfs-fix-use-of-uninitialized-variable-in-nfs_getattr.patch nfsv4-fix-races-between-nfs_remove_bad_delegation-and-delegation-return.patch nfsv4.1-nfs41_clear_delegation_stateid-shouldn-t-trust-nfs_delegated_state.patch +media-ttusb-dec-buffer-overflow-in-ioctl.patch