From: Greg Kroah-Hartman Date: Tue, 18 Nov 2014 20:27:24 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.10.61~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e677dd37b2a782b139955bbe3caf72ce89e495dd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: media-ttusb-dec-buffer-overflow-in-ioctl.patch --- diff --git a/queue-3.10/media-ttusb-dec-buffer-overflow-in-ioctl.patch b/queue-3.10/media-ttusb-dec-buffer-overflow-in-ioctl.patch new file mode 100644 index 00000000000..b8586c3eefe --- /dev/null +++ b/queue-3.10/media-ttusb-dec-buffer-overflow-in-ioctl.patch @@ -0,0 +1,31 @@ +From f2e323ec96077642d397bb1c355def536d489d16 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 5 Sep 2014 09:09:28 -0300 +Subject: media: ttusb-dec: buffer overflow in ioctl + +From: Dan Carpenter + +commit f2e323ec96077642d397bb1c355def536d489d16 upstream. + +We need to add a limit check here so we don't overflow the buffer. + +Signed-off-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/ttusb-dec/ttusbdecfe.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c ++++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c +@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_m + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00 }; + ++ if (cmd->msg_len > sizeof(b) - 4) ++ return -EINVAL; ++ + memcpy(&b[4], cmd->msg, cmd->msg_len); + + state->config->send_command(fe, 0x72, diff --git a/queue-3.10/series b/queue-3.10/series index 741834fe71f..18246c37467 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -36,3 +36,4 @@ nfsv4-ensure-that-we-remove-nfsv4.0-delegations-when-state-has-expired.patch nfs-don-t-try-to-reclaim-delegation-open-state-if-recovery-failed.patch nfs-fix-use-of-uninitialized-variable-in-nfs_getattr.patch nfsv4-fix-races-between-nfs_remove_bad_delegation-and-delegation-return.patch +media-ttusb-dec-buffer-overflow-in-ioctl.patch