mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
aa63e18e3d
The optional debugfs interface to the vendor's engineering tools wasn't bounds checking at all, which made it trivial to perform a buffer overflow if this interface was compiled in and then explicitly enabled at runtime. This patch checks both the length supplied as part of the data to ensure it is sane, and also the amount of data compared to the remaining buffer space. If either is too large, fail immediately. (This bug was spotted by Dan Carpenter <dan.carpenter@oracle.com>) Signed-off-by: Solomon Peachy <pizza@shaftnet.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> |
||
|---|---|---|
| .. | ||
| bh.c | ||
| bh.h | ||
| cw1200.h | ||
| cw1200_sdio.c | ||
| cw1200_spi.c | ||
| debug.c | ||
| debug.h | ||
| fwio.c | ||
| fwio.h | ||
| hwbus.h | ||
| hwio.c | ||
| hwio.h | ||
| itp.c | ||
| itp.h | ||
| Kconfig | ||
| main.c | ||
| Makefile | ||
| pm.c | ||
| pm.h | ||
| queue.c | ||
| queue.h | ||
| scan.c | ||
| scan.h | ||
| sta.c | ||
| sta.h | ||
| txrx.c | ||
| txrx.h | ||
| wsm.c | ||
| wsm.h | ||