diff options
| author | Cliff Wickman <cpw@sgi.com> | 2008-06-20 21:02:00 +0200 |
|---|---|---|
| committer | Tony Luck <tony.luck@intel.com> | 2008-06-20 21:02:00 +0200 |
| commit | e0c6d97c65e0784aade7e97b9411f245a6c543e7 (patch) | |
| tree | dd860efd59feb48050598035301628b79b5b954f /arch/ia64/sn | |
| parent | agp: brown paper bag patch - put back two lines that got lost (diff) | |
| download | linux-e0c6d97c65e0784aade7e97b9411f245a6c543e7.tar.xz linux-e0c6d97c65e0784aade7e97b9411f245a6c543e7.zip | |
[IA64] SN2: security hole in sn2_ptc_proc_write
Security hole in sn2_ptc_proc_write
It is possible to overrun a buffer with a write to this /proc file.
Signed-off-by: Cliff Wickman <cpw@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Diffstat (limited to 'arch/ia64/sn')
| -rw-r--r-- | arch/ia64/sn/kernel/sn2/sn2_smp.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c index 49d3120415eb..6dd886c5d860 100644 --- a/arch/ia64/sn/kernel/sn2/sn2_smp.c +++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c @@ -512,6 +512,8 @@ static ssize_t sn2_ptc_proc_write(struct file *file, const char __user *user, si int cpu; char optstr[64]; + if (count > sizeof(optstr)) + return -EINVAL; if (copy_from_user(optstr, user, count)) return -EFAULT; optstr[count - 1] = '\0'; |