diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-02-17 22:57:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-02-18 11:18:10 -0800 |
| commit | ee2104ea865f8a12eebb382aa502f248e14a5a2d (patch) | |
| tree | cde6b73b7055b23532ab124101ada52a0fa5bf77 /drivers/staging/bcm | |
| parent | cfff3e5c8d2139c38d40d90e3d9fc13721222076 (diff) | |
staging/bcm: integer underflow leads to Oom
We do:
if (NOB > DEFAULT_BUFF_SIZE)
BuffSize = DEFAULT_BUFF_SIZE;
else
BuffSize = NOB;
Since NOB can be negative it results in a larger than intended BuffSize
and makes kzalloc() fail.
The code is still a bit crap because it lets the users read as much as
they want from nvram, but I don't know what a sensible upper limit
should be.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/bcm')
| -rw-r--r-- | drivers/staging/bcm/Bcmchar.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 6f1997dc44c..5e4dfe03104 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -1894,7 +1894,7 @@ static int bcm_char_ioctl_nvm_raw_read(void __user *argp, struct bcm_mini_adapte { struct bcm_nvm_readwrite stNVMRead; struct bcm_ioctl_buffer IoBuffer; - INT NOB; + unsigned int NOB; INT BuffSize; INT ReadOffset = 0; UINT ReadBytes = 0; |