linux-kernel - [PATCH] Input: zforce_ts - fix playload length check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 27 Jul 2015 14:06:19 -0700
From:	Dmitry Torokhov <dmitry.torokhov@...il.com>
To:	linux-input@...r.kernel.org
Cc:	Dirk Behme <dirk.behme@...bosch.com>,
	Heiko Stuebner <heiko.stuebner@...com>,
	Oleksij Rempel <external.Oleksij.Rempel@...bosch.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] Input: zforce_ts - fix playload length check

Commit 7d01cd261c76f95913c81554a751968a1d282d3a ("Input: zforce - don't
overwrite the stack") attempted to add a check for payload size being too
large for the supplied buffer. Unfortunately with the currently selected
buffer size the comparison is always false as buffer size is larger than
the value a single byte can hold, and that results in compiler warnings.
Additionally the check was incorrect as it was not accounting for the
already read 2 bytes of data stored in the buffer.

Fixes: 7d01cd261c76f95913c81554a751968a1d282d3a
Reported-by: kbuild test robot <fengguang.wu@...el.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
---

This seems to shut up my GCC, I wonder if it is going to work gfor
everyone or we better add BUILD_BUG_ON(FRAME_MAXSIZE < 257) and a
comment and remove check.

 drivers/input/touchscreen/zforce_ts.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 2554efd..542ff02 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -441,7 +441,9 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
 		goto unlock;
 	}
 
-	if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
+	if (buf[PAYLOAD_LENGTH] == 0 ||
+	    (FRAME_MAXSIZE - 2 < 255 &&
+	     buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE - 2)) {
 		dev_err(&client->dev, "invalid payload length: %d\n",
 			buf[PAYLOAD_LENGTH]);
 		ret = -EIO;
-- 
2.5.0.rc2.392.g76e840b


-- 
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/