[media] [v3,media] av7110: check for negative array offset

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

info->num comes from the user. It's type int. If the user passes
in a negative value that would cause memory corruption.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

authored by

Dan Carpenter and committed by

Mauro Carvalho Chehab 15 years ago cb26a24e 76f1ef42

+1 -1

1 changed file

expand all

drivers

media

dvb

ttpci

av7110_ca.c

+1 -1

drivers/media/dvb/ttpci/av7110_ca.c

··· 277 277 { 278 278 ca_slot_info_t *info=(ca_slot_info_t *)parg; 279 279 280 - if (info->num > 1) 280 + if (info->num < 0 || info->num > 1) 281 281 return -EINVAL; 282 282 av7110->ci_slot[info->num].num = info->num; 283 283 av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?