summaryrefslogtreecommitdiff
path: root/drivers/media/rc
diff options
context:
space:
mode:
authorSean Young <sean@mess.org>2013-07-08 17:33:11 -0300
committerMauro Carvalho Chehab <m.chehab@samsung.com>2013-07-30 17:03:16 -0300
commit25379bf8bc4d4e83bd74d823048b85a95ae5a521 (patch)
tree51acef42c7d8c85ddb15ccf5a277a2c4a63ef7ee /drivers/media/rc
parent58a61f99620d635fcdaf84c9b1818b79e11d28c5 (diff)
[media] lirc: validate transmission ir data
The lirc interface allows 255 u32 spaces and pulses, which are usec. If the driver can handle this (e.g. winbond-cir) you can produce hours of meaningless IR data and there is no method of interrupting it. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers/media/rc')
-rw-r--r--drivers/media/rc/ir-lirc-codec.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index e4561264e124..e5be920c0599 100644
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -140,11 +140,20 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf,
goto out;
}
+ for (i = 0; i < count; i++) {
+ if (txbuf[i] > IR_MAX_DURATION / 1000 - duration || !txbuf[i]) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ duration += txbuf[i];
+ }
+
ret = dev->tx_ir(dev, txbuf, count);
if (ret < 0)
goto out;
- for (i = 0; i < ret; i++)
+ for (duration = i = 0; i < ret; i++)
duration += txbuf[i];
ret *= sizeof(unsigned int);