lkml.org 
[lkml]   [2010]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[01/38] PARISC: led.c - fix potential stack overflow in led_proc_write()
2.6.35-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Helge Deller <deller@gmx.de>

commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.

avoid potential stack overflow by correctly checking count parameter

Reported-by: Ilja <ilja@netric.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Kyle McMartin <kyle@mcmartin.ca>
Cc: James E.J. Bottomley <jejb@parisc-linux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/parisc/led.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct fil
size_t count, loff_t *pos)
{
void *data = PDE(file->f_path.dentry->d_inode)->data;
- char *cur, lbuf[count + 1];
+ char *cur, lbuf[32];
int d;

if (!capable(CAP_SYS_ADMIN))
return -EACCES;

- memset(lbuf, 0, count + 1);
+ if (count >= sizeof(lbuf))
+ count = sizeof(lbuf)-1;

if (copy_from_user(lbuf, buf, count))
return -EFAULT;
+ lbuf[count] = 0;

cur = lbuf;




\
 
 \ /
  Last update: 2010-08-06 20:37    [from the cache]
©2003-2011 Jasper Spaans