Commit 03eb2a55 authored by Johan Hovold's avatar Johan Hovold Committed by Mauro Carvalho Chehab
Browse files

[media] mceusb: fix NULL-deref at probe 



Make sure to check for the required out endpoint to avoid dereferencing
a NULL-pointer in mce_request_packet should a malicious device lack such
an endpoint. Note that this path is hit during probe.

Fixes: 66e89522 ("V4L/DVB: IR: add mceusb IR receiver driver")

Cc: stable <stable@vger.kernel.org>	# 2.6.36
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 74c839b2

drivers/media/rc/mceusb.c

+2 −2
Original line number Diff line number Diff line
@@ -1288,8 +1288,8 @@ static int mceusb_dev_probe(struct usb_interface *intf, 
			}

		}

	}

	if (ep_in == NULL) {

		dev_dbg(&intf->dev, "inbound and/or endpoint not found");

	if (!ep_in || !ep_out) {

		dev_dbg(&intf->dev, "required endpoints not found\n");

		return -ENODEV;

	}