redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

staging: ozwpan: Fix farewell report.

Browse source 
This patch fix following issues reported by Dan:-

1) There is no check limiting the size to 32 and it could be up to
   253 bytes.
2) Use defines instead of magic numbers.
3) The oz_farewell struct is supposed to be a variable length struct
   but the variable part is put in the middle.  It doesn't make any
   sense to put the length of the variable size array after then end
   of the array because we can never find it again!  Put the
   variable size array at the end.  Make it a zero length array.
   u8 len;
   u8 report[0];
4) In oz_add_farewell() we do this:

	f = kmalloc(sizeof(struct oz_farewell) + len - 1, GFP_ATOMIC);

    The "- 1" refers to sizeof(f->report) but because it was a magic
    number then it was missed when the sizeof(f->report) changed.
5) In [patch 6/6] we set the ->len member.  But because it is at the
   end of a variable length array with no limit check the remote
   attacker can just rewrite it using the memcpy() on the next line.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rupesh Gujare <rupesh.gujare@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rupesh Gujare 2013-08-05 12:28:33 +01:00 committed by Greg Kroah-Hartman
parent 5cf9d2577f
commit b2271b5bdf
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/staging/ozwpan/ozpd.h
View file

@ -48,8 +48,8 @@ struct oz_farewell {
struct list_head link;
u8 ep_num;
u8 index;
u8 report[32];
u8 len;
u8 report[0];
};
/* Data structure that holds information on a specific peripheral device (PD).

2
drivers/staging/ozwpan/ozproto.c
View file

@ -291,7 +291,7 @@ static void oz_add_farewell(struct oz_pd *pd, u8 ep_num, u8 index,
struct oz_farewell *f;
struct oz_farewell *f2;
int found = 0;
f = kmalloc(sizeof(struct oz_farewell) + len - 1, GFP_ATOMIC);
f = kmalloc(sizeof(struct oz_farewell) + len, GFP_ATOMIC);
if (!f)
return;
f->ep_num = ep_num;