mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 16:29:59 +00:00
Input: evdev - fix overflow in compat_ioctl
When exporting input device bitmaps via compat_ioctl on BIG_ENDIAN platforms evdev calculates data size incorrectly. This causes buffer overflow if user specifies buffer smaller than maxlen. Signed-off-by: Kenichi Nagai <kenichi3.nagai@toshiba.co.jp> Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
435b71be20
commit
bf61f8d357
1 changed files with 1 additions and 1 deletions
|
@ -336,7 +336,7 @@ static int bits_to_user(unsigned long *bits, unsigned int maxbit,
|
|||
|
||||
if (compat) {
|
||||
len = NBITS_COMPAT(maxbit) * sizeof(compat_long_t);
|
||||
if (len < maxlen)
|
||||
if (len > maxlen)
|
||||
len = maxlen;
|
||||
|
||||
for (i = 0; i < len / sizeof(compat_long_t); i++)
|
||||
|
|
Loading…
Reference in a new issue