lkml.org 
[lkml]   [2001]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [CHECKER] security errors for 2.4.9 and 2.4.9-ac7 (FIX 1 of 112)
Hi,

On Wed, Sep 5, Kenneth Michael Ashcraft wrote:
> Hi All,
>
> I've extended the security checker (makes sure that user lengths are
> bounds checked) quite a bit since my last report on July 13. The checker
> makes sure that bounds checks are present before a user length is:
...
> ---------------------------------------------------------
> [BUG] this one looks nasty. not only copy a large amount but copy it wherever (gem)
> /home/kash/linux/2.4.9/drivers/net/wan/farsync.c:1214:fst_ioctl: ERROR:RANGE:1203:1214: Using user length "size" as argument to "copy_from_user" [type=LOCAL] [state = need_ub] set by 'copy_from_user':1203 [distance=12]

I'd agree it's nasty. Don't you just love overflow math.

Fortunatly the fix is straight forward:


--- linux/drivers/net/wan/farsync.c.orig Sun Aug 12 18:38:48 2001
+++ linux/drivers/net/wan/farsync.c Wed Sep 5 09:52:33 2001
@@ -1200,7 +1200,8 @@
/* Sanity check the parameters. We don't support partial writes
* when going over the top
*/
- if ( wrthdr.size + wrthdr.offset > FST_MEMSIZE )
+ if ( wrthdr.size > FST_MEMSIZE || wrthdr.offset > FST_MEMSIZE
+ || wrthdr.size + wrthdr.offset > FST_MEMSIZE )
{
return -ENXIO;
}


--
Bob Dunlop
FarSite Communications Ltd.
http://www.farsite.co.uk/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:02    [W:0.053 / U:6.532 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site