Staging: sep: potential buffer overflow in ioctl
tail_size is determined by several variables that come from the user so we should verify that it's not too large. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
23226977e9
commit
9638b67ba2
|
@ -2120,6 +2120,8 @@ static int sep_prepare_input_output_dma_table_in_dcb(struct sep_device *sep,
|
|||
}
|
||||
}
|
||||
if (tail_size) {
|
||||
if (tail_size > sizeof(dcb_table_ptr->tail_data))
|
||||
return -EINVAL;
|
||||
if (is_kva == true) {
|
||||
memcpy(dcb_table_ptr->tail_data,
|
||||
(void *)(app_in_address + data_in_size -
|
||||
|
|
Loading…
Reference in New Issue