lkml.org 
[lkml]   [2018]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] staging: speakup: fix wraparound in uaccess length check
Jann Horn, le sam. 07 juil. 2018 03:53:44 +0200, a ecrit:
> @@ -257,6 +257,8 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
> 0x80 | (ch & 0x3f)
> };
>
> + if (chars_sent + 2 > count)
> + break;
> if (copy_to_user(cp, s, sizeof(s)))
> return -EFAULT;

Err, but then we have lost 'ch' that was consumed by the
synth_buffer_getc() call, so the fix seems wrong to me.

Nacked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Samuel

\
 
 \ /
  Last update: 2018-07-07 10:14    [W:0.103 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site