UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

Staging: bcm: Add min/max restrictions for IOCTL_BCM_REGISTER_READ_PRIVATE 

This patch fixes two issues within bcm/Bcmchar.c. The
first condition in the or statement checks if variable
IoBuffer.OutputLength, defined from user space, is
greater than the maximum value allowed for an
unsigned short. IoBuffer.OutputLength is then used
in a kmalloc call to return a pointer to memory. If
this size is greater than an unsigned short, it
becomes useless. The second condition in the or statement
checks if the same variable, IoBuffer.OutputLength is
equal to zero before invoking the kmalloc call. In
this case, if a zero size is sent to kmalloc, a valid
pointer to memory is returned instead of the expected NULL.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Kevin McKinney 2011-09-26 22:03:59 -04:00 committed by Greg Kroah-Hartman
parent d515d0ff36
commit 0a2cc4977f
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/staging/bcm/Bcmchar.c
View File

@ -216,7 +216,11 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
if (copy_from_user(&sRdmBuffer, IoBuffer.InputBuffer, IoBuffer.InputLength))
return -EFAULT;
/* FIXME: need to restrict BuffLen */
if (IoBuffer.OutputLength > USHRT_MAX ||
IoBuffer.OutputLength == 0) {
return -EINVAL;
}
Bufflen = IoBuffer.OutputLength + (4 - IoBuffer.OutputLength%4)%4;
temp_buff = kmalloc(Bufflen, GFP_KERNEL);
if (!temp_buff)