Commit 76a2c5df authored by Jiasheng Jiang's avatar Jiasheng Jiang Committed by Hans Verkuil
Browse files

media: vidtv: psi: Add check for kstrdup 



Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.

Fixes: 7a7899f6 ("media: vidtv: psi: Implement an Event Information Table (EIT)")
Fixes: c2f78f0c ("media: vidtv: psi: add a Network Information Table (NIT)")
Fixes: f90cf607 ("media: vidtv: add a bridge driver")
Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
parent 5f9fcbf9

drivers/media/test-drivers/vidtv/vidtv_psi.c

+40 −5
Original line number Diff line number Diff line
@@ -301,16 +301,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc 


	desc->service_name_len = service_name_len;



	if (service_name && service_name_len)

	if (service_name && service_name_len) {

		desc->service_name = kstrdup(service_name, GFP_KERNEL);

		if (!desc->service_name)

			goto free_desc;

	}



	desc->provider_name_len = provider_name_len;



	if (provider_name && provider_name_len)

	if (provider_name && provider_name_len) {

		desc->provider_name = kstrdup(provider_name, GFP_KERNEL);

		if (!desc->provider_name)

			goto free_desc_service_name;

	}



	vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);

	return desc;



free_desc_service_name:

	if (service_name && service_name_len)

		kfree(desc->service_name);

free_desc:

	kfree(desc);

	return NULL;

}



struct vidtv_psi_desc_registration
@@ -355,8 +368,13 @@ struct vidtv_psi_desc_network_name 


	desc->length = network_name_len;



	if (network_name && network_name_len)

	if (network_name && network_name_len) {

		desc->network_name = kstrdup(network_name, GFP_KERNEL);

		if (!desc->network_name) {

			kfree(desc);

			return NULL;

		}

	}



	vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);

	return desc;
@@ -442,15 +460,32 @@ struct vidtv_psi_desc_short_event 
		iso_language_code = "eng";



	desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL);

	if (!desc->iso_language_code)

		goto free_desc;



	if (event_name && event_name_len)

	if (event_name && event_name_len) {

		desc->event_name = kstrdup(event_name, GFP_KERNEL);

		if (!desc->event_name)

			goto free_desc_language_code;

	}



	if (text && text_len)

	if (text && text_len) {

		desc->text = kstrdup(text, GFP_KERNEL);

		if (!desc->text)

			goto free_desc_event_name;

	}



	vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);

	return desc;



free_desc_event_name:

	if (event_name && event_name_len)

		kfree(desc->event_name);

free_desc_language_code:

	kfree(desc->iso_language_code);

free_desc:

	kfree(desc);

	return NULL;

}



struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc)