bus: moxtet: fix potential stack buffer overflow
commit3bf3c97446
upstream. The input_read function declares the size of the hex array relative to sizeof(buf), but buf is a pointer argument of the function. The hex array is meant to contain hexadecimal representation of the bin array. Link: https://lore.kernel.org/r/20200215142130.22743-1-marek.behun@nic.cz Fixes:5bc7f990cd
("bus: Add support for Moxtet bus") Signed-off-by: Marek Behún <marek.behun@nic.cz> Reported-by: sohu0106 <sohu0106@126.com> Signed-off-by: Olof Johansson <olof@lixom.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
279c15b917
commit
fa3c053b83
|
@ -466,7 +466,7 @@ static ssize_t input_read(struct file *file, char __user *buf, size_t len,
|
|||
{
|
||||
struct moxtet *moxtet = file->private_data;
|
||||
u8 bin[TURRIS_MOX_MAX_MODULES];
|
||||
u8 hex[sizeof(buf) * 2 + 1];
|
||||
u8 hex[sizeof(bin) * 2 + 1];
|
||||
int ret, n;
|
||||
|
||||
ret = moxtet_spi_read(moxtet, bin);
|
||||
|
|
Loading…
Reference in New Issue