apfs/linux-apfs
0
0
Fork 0
mirror of https://github.com/linux-apfs/linux-apfs.git synced 2026-05-01 15:00:59 -07:00
Code Issues Packages Projects Releases Wiki Activity

arch: sparc: kernel: check the memory length before use strcpy().

Browse Source 
For the related next strcpy(), the destination length is less than 512,
but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
more than 512.

One work flow may:
  openprom_sunos_ioctl() ->  if (cmd == OPROMSETOPT)
    getstrings() ->  will alloc buffer with size 'OPROMMAXPARAM'.
    opromsetopt() ->  devide the buffer into 'var' and 'value'
      of_set_property() -> pass
        prom_setprop() -> pass
          ldom_set_var()

And do not mind the additional 4 alignment buffer increasing, since
'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Chen Gang
2013-06-22 13:26:09 +08:00
committed by David S. Miller
parent bfffbea1aa
commit f118e9abdd
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/sparc/kernel/ds.c
+10
View File
@@ -783,6 +783,16 @@ void ldom_set_var(const char *var, const char *value)
char *base, *p;
int msg_len, loops;
if (strlen(var) + strlen(value) + 2 >
sizeof(pkt) - sizeof(pkt.header)) {
printk(KERN_ERR PFX
"contents length: %zu, which more than max: %lu,"
"so could not set (%s) variable to (%s).\n",
strlen(var) + strlen(value) + 2,
sizeof(pkt) - sizeof(pkt.header), var, value);
return;
}
memset(&pkt, 0, sizeof(pkt));
pkt.header.data.tag.type = DS_DATA;
pkt.header.data.handle = cp->handle;