diff options
| author | Eliot Blennerhassett <eliot@blennerhassett.gen.nz> | 2014-12-31 11:48:32 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2014-12-31 14:12:43 +0100 |
| commit | 0d02e1292715d00674a49626146e3a854b504cb1 (patch) | |
| tree | a0ac354d0799db7e834d0af19e45a496acffb0ac /sound/pci/asihpi/hpi6000.c | |
| parent | Merge branch 'topic/pcm-params' into for-next (diff) | |
| download | linux-0d02e1292715d00674a49626146e3a854b504cb1.tar.xz linux-0d02e1292715d00674a49626146e3a854b504cb1.zip | |
ALSA: asihpi: fix an information leak in asihpi_hpi_ioctl()
Add missing limits to keep copied data within allocated buffer.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Eliot Blennerhassett <eliot@blennerhassett.gen.nz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/pci/asihpi/hpi6000.c')
| -rw-r--r-- | sound/pci/asihpi/hpi6000.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sound/pci/asihpi/hpi6000.c b/sound/pci/asihpi/hpi6000.c index 2414d7a2239d..2d6364825d4d 100644 --- a/sound/pci/asihpi/hpi6000.c +++ b/sound/pci/asihpi/hpi6000.c @@ -47,7 +47,7 @@ /* operational/messaging errors */ #define HPI6000_ERROR_MSG_RESP_IDLE_TIMEOUT 901 - +#define HPI6000_ERROR_RESP_GET_LEN 902 #define HPI6000_ERROR_MSG_RESP_GET_RESP_ACK 903 #define HPI6000_ERROR_MSG_GET_ADR 904 #define HPI6000_ERROR_RESP_GET_ADR 905 @@ -1365,7 +1365,10 @@ static short hpi6000_message_response_sequence(struct hpi_adapter_obj *pao, length = hpi_read_word(pdo, HPI_HIF_ADDR(length)); } while (hpi6000_check_PCI2040_error_flag(pao, H6READ) && --timeout); if (!timeout) - length = sizeof(struct hpi_response); + return HPI6000_ERROR_RESP_GET_LEN; + + if (length > phr->size) + return HPI_ERROR_RESPONSE_BUFFER_TOO_SMALL; /* get the response */ p_data = (u32 *)phr; |