Commit 12466938 authored by Sean Young's avatar Sean Young Committed by Greg Kroah-Hartman

media: digitv: don't continue if remote control state can't be read

commit eecc70d2 upstream.

This results in an uninitialized variable read.

Reported-by: syzbot+6bf9606ee955b646c0e1@syzkaller.appspotmail.com
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1764dc15
...@@ -233,18 +233,22 @@ static struct rc_map_table rc_map_digitv_table[] = { ...@@ -233,18 +233,22 @@ static struct rc_map_table rc_map_digitv_table[] = {
static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state) static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
{ {
int i; int ret, i;
u8 key[5]; u8 key[5];
u8 b[4] = { 0 }; u8 b[4] = { 0 };
*event = 0; *event = 0;
*state = REMOTE_NO_KEY_PRESSED; *state = REMOTE_NO_KEY_PRESSED;
digitv_ctrl_msg(d,USB_READ_REMOTE,0,NULL,0,&key[1],4); ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, &key[1], 4);
if (ret)
return ret;
/* Tell the device we've read the remote. Not sure how necessary /* Tell the device we've read the remote. Not sure how necessary
this is, but the Nebula SDK does it. */ this is, but the Nebula SDK does it. */
digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0); ret = digitv_ctrl_msg(d, USB_WRITE_REMOTE, 0, b, 4, NULL, 0);
if (ret)
return ret;
/* if something is inside the buffer, simulate key press */ /* if something is inside the buffer, simulate key press */
if (key[1] != 0) if (key[1] != 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment