Prev: [08/34] parisc: pass through \t to early (iodc) console
Next: [25/34] CIFS: Remove __exit mark from cifs_exit_dns_resolver()
From: Greg KH on 6 Aug 2010 15:20
2.6.32-stable review patch. If anyone has any objections, please let us know.

------------------

From: Helge Deller <deller(a)gmx.de>

commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.

avoid potential stack overflow by correctly checking count parameter

Reported-by: Ilja <ilja(a)netric.org>
Signed-off-by: Helge Deller <deller(a)gmx.de>
Acked-by: Kyle McMartin <kyle(a)mcmartin.ca>
Cc: James E.J. Bottomley <jejb(a)parisc-linux.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
drivers/parisc/led.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -182,16 +182,18 @@ static int led_proc_read(char *page, cha
static int led_proc_write(struct file *file, const char *buf,
unsigned long count, void *data)
{
- char *cur, lbuf[count + 1];
+ char *cur, lbuf[32];
int d;

if (!capable(CAP_SYS_ADMIN))
return -EACCES;

- memset(lbuf, 0, count + 1);
+ if (count >= sizeof(lbuf))
+ count = sizeof(lbuf)-1;

if (copy_from_user(lbuf, buf, count))
return -EFAULT;
+ lbuf[count] = 0;

cur = lbuf;



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [08/34] parisc: pass through \t to early (iodc) console
Next: [25/34] CIFS: Remove __exit mark from cifs_exit_dns_resolver()