summaryrefslogtreecommitdiffstats
path: root/drivers/staging/bcm
diff options
context:
space:
mode:
authorKevin McKinney <klmckinney1@gmail.com>2011-09-26 22:03:59 -0400
committerGreg Kroah-Hartman <gregkh@suse.de>2011-09-29 17:34:51 -0700
commit0a2cc4977ffd551b58ae20c646bd7083ba5a89d2 (patch)
treeda3285cfe34ffaf5047097ad18ba0334799d9b02 /drivers/staging/bcm
parentd515d0ff36a7afd528f32e3511780ad8385d957e (diff)
Staging: bcm: Add min/max restrictions for IOCTL_BCM_REGISTER_READ_PRIVATE
This patch fixes two issues within bcm/Bcmchar.c. The first condition in the or statement checks if variable IoBuffer.OutputLength, defined from user space, is greater than the maximum value allowed for an unsigned short. IoBuffer.OutputLength is then used in a kmalloc call to return a pointer to memory. If this size is greater than an unsigned short, it becomes useless. The second condition in the or statement checks if the same variable, IoBuffer.OutputLength is equal to zero before invoking the kmalloc call. In this case, if a zero size is sent to kmalloc, a valid pointer to memory is returned instead of the expected NULL. Signed-off-by: Kevin McKinney <klmckinney1@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/bcm')
-rw-r--r--drivers/staging/bcm/Bcmchar.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index 4c433538397..867c65c4375 100644
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -216,7 +216,11 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
if (copy_from_user(&sRdmBuffer, IoBuffer.InputBuffer, IoBuffer.InputLength))
return -EFAULT;
- /* FIXME: need to restrict BuffLen */
+ if (IoBuffer.OutputLength > USHRT_MAX ||
+ IoBuffer.OutputLength == 0) {
+ return -EINVAL;
+ }
+
Bufflen = IoBuffer.OutputLength + (4 - IoBuffer.OutputLength%4)%4;
temp_buff = kmalloc(Bufflen, GFP_KERNEL);
if (!temp_buff)