]> git.baikalelectronics.ru Git - kernel.git/commit
firewire: cdev: check write quadlet request length to avoid buffer overflow
authorClemens Ladisch <clemens@ladisch.de>
Wed, 7 Jul 2010 12:37:30 +0000 (14:37 +0200)
committerStefan Richter <stefanr@s5r6.in-berlin.de>
Tue, 13 Jul 2010 07:47:47 +0000 (09:47 +0200)
commiteddf98e23a57ce5dac4aaa29e82752806ae23aba
tree9165f872029ef76e99fd40c0afb6d8c896f8cabc
parent7c41a884746b9c0488e5b94c685a1b0df22fb7f0
firewire: cdev: check write quadlet request length to avoid buffer overflow

Check that the data length of a write quadlet request actually is large
enough for a quadlet.  Otherwise, fw_fill_request could access the four
bytes after the end of the outbound_transaction_event structure.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Modification of Clemens' change:  Consolidate the check into
init_request() which is used by the affected ioctl_send_request() and
ioctl_send_broadcast_request() and the unaffected
ioctl_send_stream_packet(), to save a few lines of code.

Note, since struct outbound_transaction_event *e is slab-allocated, such
an out-of-bounds access won't hit unallocated memory but may result in a
(virtually impossible to exploit) information disclosure.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
drivers/firewire/core-cdev.c