Messages in this thread Patch in this message |  | | Subject | [PATCH] Possible off by one in drivers/parport/probe.c | | From | Alexander Nyberg <> | | Date | Wed, 01 Dec 2004 18:02:15 +0100 |
| |
Hi!
This fixes a theoretical bug indicated in: http://bugme.osdl.org/show_bug.cgi?id=240
It prevents overflow in case the required buffer is larger than the passed buffer. This I found to be the minimally intrusive change.
If anyone could test this change using parport with "IEEE 1284 transfer modes" (CONFIG_PARPORT_1284) hardware it would be nice.
Signed-off-by: Alexander Nyberg <alexn@dsv.su.se>
===== drivers/parport/probe.c 1.6 vs edited ===== --- 1.6/drivers/parport/probe.c 2004-10-28 09:39:58 +02:00 +++ edited/drivers/parport/probe.c 2004-12-01 17:02:43 +01:00 @@ -164,8 +164,16 @@ ssize_t parport_device_id (int devnum, c if (retval != 2) goto end_id; idlen = (length[0] << 8) + length[1] - 2; - if (idlen < len) + /* + * Check if the caller-allocated buffer is large enough + * otherwise bail out or there will be an at least off by one. + */ + if (idlen + 1 < len) len = idlen; + else { + retval = -ENOMEM; + goto out; + } retval = parport_read (dev->port, buffer, len); if (retval != len) @@ -205,11 +213,12 @@ ssize_t parport_device_id (int devnum, c buffer[len] = '\0'; parport_negotiate (dev->port, IEEE1284_MODE_COMPAT); } - parport_release (dev); if (retval > 2) parse_data (dev->port, dev->daisy, buffer); +out: + parport_release (dev); parport_close (dev); return retval; }
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |