lkml.org 
[lkml]   [2001]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [CHECKER] Probable Security Errors in 2.4.12-ac3
On Sat, Oct 20 2001, Ken Ashcraft wrote:
> ---------------------------------------------------------
> [BUG] needs upper bound
> /home/kash/linux/2.4.12/drivers/cdrom/cdrom.c:2019:mmc_ioctl: ERROR:RANGE:2012:2019: [LOOP] Looping on user length "nr" set by 'copy_from_user':2018 [linkages -> 2018:nr=nframes -> 2012:ra:start] [distance=26]
> lba = ra.addr.lba;
> else
> return -EINVAL;
>
> /* FIXME: we need upper bound checking, too!! */
> Start --->
> if (lba < 0 || ra.nframes <= 0)
> return -EINVAL;
>
> /*
> * start with will ra.nframes size, back down if alloc fails
> */
> nr = ra.nframes;
> Error --->
> do {
> cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
> if (cgc.buffer)
> break;

Here's a fix for that. Linus, please apply.

--
Jens Axboe

--- drivers/cdrom/cdrom.c~ Tue Oct 23 09:28:35 2001
+++ drivers/cdrom/cdrom.c Tue Oct 23 09:29:23 2001
@@ -2009,7 +2009,7 @@
return -EINVAL;

/* FIXME: we need upper bound checking, too!! */
- if (lba < 0 || ra.nframes <= 0)
+ if (lba < 0 || ra.nframes <= 0 || ra.nframes > 64)
return -EINVAL;

/*
\
 
 \ /
  Last update: 2005-03-22 13:10    [W:0.120 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site