From cf32802d7620d7f0e7b1c360cdd5821f2d10a3b0 Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Mon, 2 Aug 2010 22:46:41 +0200 Subject: PARISC: led.c - fix potential stack overflow in led_proc_write() commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream. avoid potential stack overflow by correctly checking count parameter Reported-by: Ilja Signed-off-by: Helge Deller Acked-by: Kyle McMartin Cc: James E.J. Bottomley Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/parisc/led.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c index f9b12664f9fb..299b4e6e95af 100644 --- a/drivers/parisc/led.c +++ b/drivers/parisc/led.c @@ -182,16 +182,18 @@ static int led_proc_read(char *page, char **start, off_t off, int count, static int led_proc_write(struct file *file, const char *buf, unsigned long count, void *data) { - char *cur, lbuf[count + 1]; + char *cur, lbuf[32]; int d; if (!capable(CAP_SYS_ADMIN)) return -EACCES; - memset(lbuf, 0, count + 1); + if (count >= sizeof(lbuf)) + count = sizeof(lbuf)-1; if (copy_from_user(lbuf, buf, count)) return -EFAULT; + lbuf[count] = 0; cur = lbuf; -- cgit v1.2.3