lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 5 Jul 2018 01:47:01 +0100 From: Al Viro <viro@...IV.linux.org.uk> To: Daniel Rosenberg <drosen@...gle.com> Cc: Jiri Kosina <jikos@...nel.org>, Benjamin Tissoires <benjamin.tissoires@...hat.com>, linux-input@...r.kernel.org, linux-kernel@...r.kernel.org, kernel-team@...roid.com, stable@...r.kernel.org Subject: Re: [PATCH] HID: debug: check length before copy_to_user() On Mon, Jul 02, 2018 at 04:59:37PM -0700, Daniel Rosenberg wrote: > If our length is greater than the size of the buffer, we > overflow the buffer Hmm... How about this: buf = list->hid_debug_buf; if (list->tail < list->head) { ret = simple_read_from_buffer(buffer, count, &list->head, buf, HID_DEBUG_BUFSIZE); if (ret < 0) break; if (list->head != buf + HID_DEBUG_BUFSIZE) break; list->head = 0; } n = simple_read_from_buffer(buffer + ret, count - ret, &list->head, buf, list->tail); if (n >= 0) ret += n; if (list->head == buf + HID_DEBUG_BUFSIZE) list->head = 0; instead?
Powered by blists - more mailing lists