diff options
| author | Johan Hovold <johan@kernel.org> | 2017-03-13 09:53:54 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-04-10 07:29:20 -0300 |
| commit | d5823511c0f8719a39e72ede1bce65411ac653b7 (patch) | |
| tree | a770c803b345b82c614be5d63282b69a9354f715 /drivers/media | |
| parent | bff8ff6528bba99ca2e405dd59aaf06f0a4b5f65 (diff) | |
| download | linux-d5823511c0f8719a39e72ede1bce65411ac653b7.tar.bz2 | |
[media] dib0700: fix NULL-deref at probe
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: c4018fa2e4c0 ("[media] dib0700: fix RC support on Hauppauge
Nova-TD")
Cc: stable <stable@vger.kernel.org> # 3.16
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/usb/dvb-usb/dib0700_core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c index dd5edd3a17ee..08acdd32e412 100644 --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -809,6 +809,9 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf) /* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ + if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1) + return -ENODEV; + purb = usb_alloc_urb(0, GFP_KERNEL); if (purb == NULL) return -ENOMEM; |