Messages in this thread Patch in this message | | | Date | Tue, 27 May 2003 13:05:07 -0500 | Subject | [CHECKER] [PATCH] zortran user-pointer fix | From | Hollis Blanchard <> |
| |
Here's what the Stanford checker said: --------------------------------------------------------- [BUG] proc_dir_entry.write_proc
/home/junfeng/linux-2.5.63/drivers/media/video/ zoran_procfs.c:122:zoran_write_proc: ERROR:TAINTED:122:122: passing tainted ptr 'buffer' to __memcpy [Callstack: /home/junfeng/linux-2.5.63/net/core/ pktgen.c:991:zoran_write_proc((tainted 1))]
string = sp = vmalloc(count + 1); if (!string) { printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name); return -ENOMEM; }
Error ---> memcpy(string, buffer, count); string[count] = 0; DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data)); ldelim = " \t\n"; ---------------------------------------------------------
Is this patch correct?
-- Hollis Blanchard IBM Linux Technology Center --- linux-2.5.69/drivers/media/video/zoran_procfs.c.orig 2003-05-23 15:42:18.000000000 -0500 +++ linux-2.5.69/drivers/media/video/zoran_procfs.c 2003-05-23 15:42:40.000000000 -0500 @@ -119,7 +119,10 @@ printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name); return -ENOMEM; } - memcpy(string, buffer, count); + if (copy_from_user(string, buffer, count)) { + vfree(string); + return -EFAULT; + } string[count] = 0; DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data)); ldelim = " \t\n"; | |