summaryrefslogtreecommitdiffstats
path: root/drivers/parisc
diff options
context:
space:
mode:
authorHelge Deller <deller@gmx.de>2010-08-02 22:46:41 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2010-08-03 09:11:42 -0700
commit4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 (patch)
tree8fbdbf091b7378e03b9bfb80a12f791d942ba86c /drivers/parisc
parent9fe6206f400646a2322096b56c59891d530e8d51 (diff)
PARISC: led.c - fix potential stack overflow in led_proc_write()
avoid potential stack overflow by correctly checking count parameter Reported-by: Ilja <ilja@netric.org> Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Kyle McMartin <kyle@mcmartin.ca> Cc: James E.J. Bottomley <jejb@parisc-linux.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/parisc')
-rw-r--r--drivers/parisc/led.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index 188bc8496a2..d02be78a413 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct file *file, const char *buf,
size_t count, loff_t *pos)
{
void *data = PDE(file->f_path.dentry->d_inode)->data;
- char *cur, lbuf[count + 1];
+ char *cur, lbuf[32];
int d;
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
- memset(lbuf, 0, count + 1);
+ if (count >= sizeof(lbuf))
+ count = sizeof(lbuf)-1;
if (copy_from_user(lbuf, buf, count))
return -EFAULT;
+ lbuf[count] = 0;
cur = lbuf;