diff options
| author | Helge Deller <deller@gmx.de> | 2010-08-02 22:46:41 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-08-10 10:20:37 -0700 |
| commit | 250fac9f6418d573e8031ad0ad0028585034e80d (patch) | |
| tree | 56be5506fd0b2481bb0115fb373fd027d28805d4 | |
| parent | 0c88c156dfb335e3ae4fc50a76b88082544d1d3c (diff) | |
PARISC: led.c - fix potential stack overflow in led_proc_write()
commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.
avoid potential stack overflow by correctly checking count parameter
Reported-by: Ilja <ilja@netric.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Kyle McMartin <kyle@mcmartin.ca>
Cc: James E.J. Bottomley <jejb@parisc-linux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/parisc/led.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c index 9581d3619450..cc31baa31659 100644 --- a/drivers/parisc/led.c +++ b/drivers/parisc/led.c @@ -182,16 +182,18 @@ static int led_proc_read(char *page, char **start, off_t off, int count, static int led_proc_write(struct file *file, const char *buf, unsigned long count, void *data) { - char *cur, lbuf[count + 1]; + char *cur, lbuf[32]; int d; if (!capable(CAP_SYS_ADMIN)) return -EACCES; - memset(lbuf, 0, count + 1); + if (count >= sizeof(lbuf)) + count = sizeof(lbuf)-1; if (copy_from_user(lbuf, buf, count)) return -EFAULT; + lbuf[count] = 0; cur = lbuf; |