]> git.hungrycats.org Git - linux/commit
media: pulse8-cec: fix data timestamp at pulse8_setup()
authorMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Wed, 16 Oct 2024 09:24:15 +0000 (11:24 +0200)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Fri, 18 Oct 2024 08:43:03 +0000 (10:43 +0200)
commitba9cf6b430433e57bfc8072364e944b7c0eca2a4
treef238cab4d8a4ad2bb1313125b748dc42fe1f8ba4
parenteba6a8619d2b988f9b3a34e6b552a34fa2057d61
media: pulse8-cec: fix data timestamp at pulse8_setup()

As pointed by Coverity, there is a hidden overflow condition there.
As date is signed and u8 is unsigned, doing:

date = (data[0] << 24)

With a value bigger than 07f will make all upper bits of date
0xffffffff. This can be demonstrated with this small code:

<code>
typedef int64_t time64_t;
typedef uint8_t u8;

int main(void)
{
u8 data[] = { 0xde ,0xad , 0xbe, 0xef };
time64_t date;

date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
printf("Invalid data = 0x%08lx\n", date);

date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
printf("Expected data = 0x%08lx\n", date);

return 0;
}
</code>

Fix it by converting the upper bit calculation to unsigned.

Fixes: cea28e7a55e7 ("media: pulse8-cec: reorganize function order")
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/cec/usb/pulse8/pulse8-cec.c