media: iguanair: add sanity checks (ab1cbdf1) · Commits · 戴 / test

The driver needs to check the endpoint types, too, as opposed to the number of endpoints. This also requires moving the check earlier. Reported-by:

drivers/media/rc/iguanair.c

+7 −8

Original line number	Diff line number	Diff line
		@@ -413,6 +413,10 @@ static int iguanair_probe(struct usb_interface *intf,
		int ret, pipein, pipeout;
		struct usb_host_interface *idesc;

		idesc = intf->altsetting;
		if (idesc->desc.bNumEndpoints < 2)
		return -ENODEV;

		ir = kzalloc(sizeof(*ir), GFP_KERNEL);
		rc = rc_allocate_device(RC_DRIVER_IR_RAW);
		if (!ir \|\| !rc) {
		@@ -427,18 +431,13 @@ static int iguanair_probe(struct usb_interface *intf,
		ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
		ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);

		if (!ir->buf_in \|\| !ir->packet \|\| !ir->urb_in \|\| !ir->urb_out) {
		if (!ir->buf_in \|\| !ir->packet \|\| !ir->urb_in \|\| !ir->urb_out \|\|
		!usb_endpoint_is_int_in(&idesc->endpoint[0].desc) \|\|
		!usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
		ret = -ENOMEM;
		goto out;
		}

		idesc = intf->altsetting;

		if (idesc->desc.bNumEndpoints < 2) {
		ret = -ENODEV;
		goto out;
		}

		ir->rc = rc;
		ir->dev = &intf->dev;
		ir->udev = udev;