lkml.org 
[lkml]   [2010]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[01/38] PARISC: led.c - fix potential stack overflow in led_proc_write()
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Helge Deller <deller@gmx.de>

    commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.

    avoid potential stack overflow by correctly checking count parameter

    Reported-by: Ilja <ilja@netric.org>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Acked-by: Kyle McMartin <kyle@mcmartin.ca>
    Cc: James E.J. Bottomley <jejb@parisc-linux.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/parisc/led.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/drivers/parisc/led.c
    +++ b/drivers/parisc/led.c
    @@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct fil
    size_t count, loff_t *pos)
    {
    void *data = PDE(file->f_path.dentry->d_inode)->data;
    - char *cur, lbuf[count + 1];
    + char *cur, lbuf[32];
    int d;

    if (!capable(CAP_SYS_ADMIN))
    return -EACCES;

    - memset(lbuf, 0, count + 1);
    + if (count >= sizeof(lbuf))
    + count = sizeof(lbuf)-1;

    if (copy_from_user(lbuf, buf, count))
    return -EFAULT;
    + lbuf[count] = 0;

    cur = lbuf;




    \
     
     \ /
      Last update: 2010-08-06 20:37    [W:0.024 / U:0.452 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site