This patch fixes two issues within bcm/Bcmchar.c. The
first condition in the or statement checks if variable
IoBuffer.OutputLength, defined from user space, is
greater than the maximum value allowed for an
unsigned short. IoBuffer.OutputLength is then used
in a kmalloc call to return a pointer to memory. If
this size is greater than an unsigned short, it
becomes useless. The second condition in the or statement
checks if the same variable, IoBuffer.OutputLength is
equal to zero before invoking the kmalloc call. In
this case, if a zero size is sent to kmalloc, a valid
pointer to memory is returned instead of the expected NULL.
Signed-off-by: Kevin McKinney <klmckinney1@xxxxxxxxx>
---
drivers/staging/bcm/Bcmchar.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index e110d0e..7cffbdd 100644
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -306,7 +306,11 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
if (copy_from_user(&sRdmBuffer, IoBuffer.InputBuffer, IoBuffer.InputLength))
return -EFAULT;
- /* FIXME: don't trust user supplied length */
+ if (IoBuffer.OutputLength > USHRT_MAX ||
+ IoBuffer.OutputLength == 0) {
+ return -EINVAL;
+ }
+
temp_buff = kmalloc(IoBuffer.OutputLength, GFP_KERNEL);
if (!temp_buff)
return STATUS_FAILURE;
--
1.7.4.1
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
