Commit 4b4fd27c authored by Helge Deller's avatar Helge Deller Committed by Linus Torvalds

PARISC: led.c - fix potential stack overflow in led_proc_write()

avoid potential stack overflow by correctly checking count parameter
Reported-by: default avatarIlja <ilja@netric.org>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Acked-by: default avatarKyle McMartin <kyle@mcmartin.ca>
Cc: James E.J. Bottomley <jejb@parisc-linux.org>
Cc: stable@kernel.org
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 9fe6206f
...@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct file *file, const char *buf, ...@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct file *file, const char *buf,
size_t count, loff_t *pos) size_t count, loff_t *pos)
{ {
void *data = PDE(file->f_path.dentry->d_inode)->data; void *data = PDE(file->f_path.dentry->d_inode)->data;
char *cur, lbuf[count + 1]; char *cur, lbuf[32];
int d; int d;
if (!capable(CAP_SYS_ADMIN)) if (!capable(CAP_SYS_ADMIN))
return -EACCES; return -EACCES;
memset(lbuf, 0, count + 1); if (count >= sizeof(lbuf))
count = sizeof(lbuf)-1;
if (copy_from_user(lbuf, buf, count)) if (copy_from_user(lbuf, buf, count))
return -EFAULT; return -EFAULT;
lbuf[count] = 0;
cur = lbuf; cur = lbuf;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment