Messages in this thread | | | Date | Tue, 06 Mar 2007 20:21:09 +0000 | From | Simon Arlott <> | Subject | Re: [PATCH] Fix buffer overflow in Omnikey CardMan 4040 driver |
| |
On 06/03/07 21:12, Marcel Holtmann wrote: > Hi Linus, > > the attached patch fixes a buffer overflow in the Omnikey CardMan 4040 > driver that could lead to a potential arbitrary code execution with > kernel privileges. > > Regards > > Marcel >
- if (count < 5) { + if ((count < 5) || (count > READ_WRITE_BUFFER_SIZE)) { DEBUGP(2, dev, "<- cm4040_write buffersize=%Zd < 5\n", count); return -EIO; }
That debug message needs to be changed too since count won't always be < 5 when it's used.
-- Simon Arlott - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |