Commit 1c2de820 authored by Yongjian Xu's avatar Yongjian Xu Committed by Greg Kroah-Hartman

char: Int overflow in lp_do_ioctl().

arg comes from user-space, so int overflow may occur:
	LP_TIME(minor) = arg * HZ/100;
Reported-by: default avatarYongjian Xu <xuyongjiande@gmail.com>
Suggested-by: default avatarQixue Xiao <s2exqx@gmail.com>
Signed-off-by: default avatarYu Chen <chyyuu@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 138a6d7e
......@@ -587,6 +587,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
return -ENODEV;
switch ( cmd ) {
case LPTIME:
if (arg > UINT_MAX / HZ)
return -EINVAL;
LP_TIME(minor) = arg * HZ/100;
break;
case LPCHAR:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment