Messages in this thread | | | Date | Wed, 11 May 2016 10:58:13 -0700 | From | Olof Johansson <> | Subject | Re: [PATCH v3] platform/chrome: cros_ec_dev - Fix security issue |
| |
On Tue, Mar 08, 2016 at 09:13:52AM -0800, Gwendal Grignou wrote: > Prevent memory scribble by checking that ioctl buffer size parameters > are sane. > Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and > .outsize the amount to scribble, we would overflow, allocate a small > amounts and be able to write outside of the malloc'ed area. > Adding a hard limit allows argument checking of the ioctl. With the > current EC, it is expected .insize and .outsize to be at around 512 bytes > or less. > > Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Applied now.
-Olof
| |