forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/media/dvb/dvb-core
History
Ang Way Chuang 7ca5552dc5 dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered by an invalid Payload Pointer 
commit 29e1fa3565 upstream.

ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
has a bug that causes endless loop when Payload Pointer of MPEG2-TS
frame is 182 or 183.  Anyone who sends malicious MPEG2-TS frame will
cause the receiver of ULE SNDU to go into endless loop.

This patch was generated and tested against linux-2.6.32.9 and should
apply cleanly to linux-2.6.33 as well because there was only one typo
fix to dvb_net.c since v2.6.32.

This bug was brought to you by modern day Santa Claus who decided to
shower the satellite dish at Keio University with heavy snow causing
huge burst of errors.  We, receiver end, received Santa Claus's gift in
the form of kernel bug.

Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code for I always produces buggy code.

Signed-off-by: Ang Way Chuang <wcang79@gmail.com>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-15 08:49:46 -07:00
..
demux.h V4L/DVB (8131): dmx_write: memcpy from user-supplied pointer 2008-07-20 07:13:27 -03:00
dmxdev.c V4L/DVB: dvb-core: fix initialization of feeds list in demux filter 2010-02-23 07:37:51 -08:00
dmxdev.h V4L/DVB (12275): Add two new ioctls: DMX_ADD_PID and DMX_REMOVE_PID 2009-09-12 12:17:43 -03:00
dvb_ca_en50221.c V4L/DVB (10391): dvb: constify VFTs 2009-03-30 12:42:34 -03:00
dvb_ca_en50221.h V4L/DVB (9054): implement proper locking in the dvb ca en50221 driver 2009-01-29 08:35:37 -02:00
dvb_demux.c headers: remove sched.h from poll.h 2009-10-04 15:05:10 -07:00
dvb_demux.h V4L/DVB (11930): TS continuity check: show error message when discontinuity detected or TEI flag detected in header 2009-06-16 19:07:23 -03:00
dvb_filter.c
dvb_filter.h
dvb_frontend.c drivers/media/dvb/dvb-core/dvb_frontend.c: needs semaphore.h 2009-12-01 16:32:19 -08:00
dvb_frontend.h V4L/DVB (12997): Add the DTV_ISDB_TS_ID property for ISDB_S 2009-09-19 00:51:34 -03:00
dvb_math.c
dvb_math.h
dvb_net.c dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered by an invalid Payload Pointer 2010-03-15 08:49:46 -07:00
dvb_net.h
dvb_ringbuffer.c V4L/DVB (8130): split dvb_ringbuffer dual-use functions 2008-07-20 07:13:23 -03:00
dvb_ringbuffer.h V4L/DVB (8130): split dvb_ringbuffer dual-use functions 2008-07-20 07:13:23 -03:00
dvbdev.c Driver-Core: extend devnode callbacks to provide permissions 2009-09-19 12:50:38 -07:00
dvbdev.h V4L/DVB (13038): dvbdev: Remove an anoying/uneeded warning 2009-09-22 21:54:00 -03:00
Makefile