From: Kevin McKinney Date: Tue, 27 Sep 2011 02:03:59 +0000 (-0400) Subject: Staging: bcm: Add min/max restrictions for IOCTL_BCM_REGISTER_READ_PRIVATE X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=0a2cc4977ffd551b58ae20c646bd7083ba5a89d2;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git Staging: bcm: Add min/max restrictions for IOCTL_BCM_REGISTER_READ_PRIVATE This patch fixes two issues within bcm/Bcmchar.c. The first condition in the or statement checks if variable IoBuffer.OutputLength, defined from user space, is greater than the maximum value allowed for an unsigned short. IoBuffer.OutputLength is then used in a kmalloc call to return a pointer to memory. If this size is greater than an unsigned short, it becomes useless. The second condition in the or statement checks if the same variable, IoBuffer.OutputLength is equal to zero before invoking the kmalloc call. In this case, if a zero size is sent to kmalloc, a valid pointer to memory is returned instead of the expected NULL. Signed-off-by: Kevin McKinney Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 4c4335383977..867c65c4375d 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -216,7 +216,11 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg) if (copy_from_user(&sRdmBuffer, IoBuffer.InputBuffer, IoBuffer.InputLength)) return -EFAULT; - /* FIXME: need to restrict BuffLen */ + if (IoBuffer.OutputLength > USHRT_MAX || + IoBuffer.OutputLength == 0) { + return -EINVAL; + } + Bufflen = IoBuffer.OutputLength + (4 - IoBuffer.OutputLength%4)%4; temp_buff = kmalloc(Bufflen, GFP_KERNEL); if (!temp_buff)