libertas: potential oops in debugfs
If we do a zero size allocation then it will oops. Also we can't be sure the user passes us a NUL terminated string so I've added a terminator. This code can only be triggered by root. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
450991fd2f
commit
a497e47d4a
|
@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
|
|||
char *p2;
|
||||
struct debug_data *d = f->private_data;
|
||||
|
||||
pdata = kmalloc(cnt, GFP_KERNEL);
|
||||
if (cnt == 0)
|
||||
return 0;
|
||||
|
||||
pdata = kmalloc(cnt + 1, GFP_KERNEL);
|
||||
if (pdata == NULL)
|
||||
return 0;
|
||||
|
||||
|
@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
|
|||
kfree(pdata);
|
||||
return 0;
|
||||
}
|
||||
pdata[cnt] = '\0';
|
||||
|
||||
p0 = pdata;
|
||||
for (i = 0; i < num_of_items; i++) {
|
||||
|
|
Loading…
Reference in a new issue