From 0a2cc4977ffd551b58ae20c646bd7083ba5a89d2 Mon Sep 17 00:00:00 2001 From: Kevin McKinney Date: Mon, 26 Sep 2011 22:03:59 -0400 Subject: [PATCH] Staging: bcm: Add min/max restrictions for IOCTL_BCM_REGISTER_READ_PRIVATE This patch fixes two issues within bcm/Bcmchar.c. The first condition in the or statement checks if variable IoBuffer.OutputLength, defined from user space, is greater than the maximum value allowed for an unsigned short. IoBuffer.OutputLength is then used in a kmalloc call to return a pointer to memory. If this size is greater than an unsigned short, it becomes useless. The second condition in the or statement checks if the same variable, IoBuffer.OutputLength is equal to zero before invoking the kmalloc call. In this case, if a zero size is sent to kmalloc, a valid pointer to memory is returned instead of the expected NULL. Signed-off-by: Kevin McKinney Signed-off-by: Greg Kroah-Hartman --- drivers/staging/bcm/Bcmchar.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 4c4335383977..867c65c4375d 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -216,7 +216,11 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg) if (copy_from_user(&sRdmBuffer, IoBuffer.InputBuffer, IoBuffer.InputLength)) return -EFAULT; - /* FIXME: need to restrict BuffLen */ + if (IoBuffer.OutputLength > USHRT_MAX || + IoBuffer.OutputLength == 0) { + return -EINVAL; + } + Bufflen = IoBuffer.OutputLength + (4 - IoBuffer.OutputLength%4)%4; temp_buff = kmalloc(Bufflen, GFP_KERNEL); if (!temp_buff) -- 2.34.1