lkml.org 
[lkml]   [2007]   [Mar]   [6]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateTue, 06 Mar 2007 20:21:09 +0000
FromSimon Arlott <>
SubjectRe: [PATCH] Fix buffer overflow in Omnikey CardMan 4040 driver
On 06/03/07 21:12, Marcel Holtmann wrote:
> Hi Linus,
> 
> the attached patch fixes a buffer overflow in the Omnikey CardMan 4040
> driver that could lead to a potential arbitrary code execution with
> kernel privileges.
> 
> Regards
> 
> Marcel
> 

-	if (count < 5) {
+	if ((count < 5) || (count > READ_WRITE_BUFFER_SIZE)) {
 		DEBUGP(2, dev, "<- cm4040_write buffersize=%Zd < 5\n", count);
 		return -EIO;
 	}
That debug message needs to be changed too since count won't always 
be < 5 when it's used.

-- 
Simon Arlott
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-03-06 21:25    [from the cache]
©2003-2008