| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20100218183753.8212.3164.stgit@localhost.localdomain> Date: Thu, 18 Feb 2010 18:39:16 +0000 From: Alan Cox <alan@...ux.intel.com> To: mchehab@...radead.org, linux-kernel@...r.kernel.org Subject: [RESEND PATCH] dvb: copy_from_user checks I don't believe the frag count can ever get loaded with a negative value even with the -2 but neither the compiler (nor I ;)) can prove it so keep us both happy. Signed-off-by: Alan Cox <alan@...ux.intel.com> --- drivers/media/dvb/dvb-core/dvb_ca_en50221.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c index cb22da5..2cf03e9 100644 --- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c @@ -1280,7 +1280,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file, u8 slot, connection_id; int status; u8 fragbuf[HOST_LINK_BUF_SIZE]; - int fragpos = 0; + unsigned int fragpos = 0; int fraglen; unsigned long timeout; int written; @@ -1308,6 +1308,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file, fraglen = ca->slot_info[slot].link_buf_size - 2; if ((count - fragpos) < fraglen) fraglen = count - fragpos; + if (fraglen < 0) + fraglen = 0; fragbuf[0] = connection_id; fragbuf[1] = ((fragpos + fraglen) < count) ? 0x80 : 0x00; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists