[media] lirc: validate transmission ir data

The lirc interface allows 255 u32 spaces and pulses, which are usec. If
the driver can handle this (e.g. winbond-cir) you can produce hours of
meaningless IR data and there is no method of interrupting it.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index e4561264e12439a8f24f2a63e94ac2572b0d47a0..e5be920c059978d3194d1159c1f1a1419879eb58 100644 (file)
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -140,11 +140,20 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf,
                goto out;
        }
 
+       for (i = 0; i < count; i++) {
+               if (txbuf[i] > IR_MAX_DURATION / 1000 - duration || !txbuf[i]) {
+                       ret = -EINVAL;
+                       goto out;
+               }
+
+               duration += txbuf[i];
+       }
+
        ret = dev->tx_ir(dev, txbuf, count);
        if (ret < 0)
                goto out;
 
-       for (i = 0; i < ret; i++)
+       for (duration = i = 0; i < ret; i++)
                duration += txbuf[i];
 
        ret *= sizeof(unsigned int);