diff options
| author | Heikki Orsila <shd@jolt.modeemi.cs.tut.fi> | 2006-04-19 17:01:01 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-04-24 09:56:04 -0700 |
| commit | 3696ee36c993baee282a7be6245c7e7df5db1f83 (patch) | |
| tree | c097cdd4d9d441bd5ea10068935c9ef4f0b04cda | |
| parent | 3e5a2e956fff9e975e1b76c4de314cd077c6ec87 (diff) | |
| download | kernel-common-3696ee36c993baee282a7be6245c7e7df5db1f83.tar.gz kernel-common-3696ee36c993baee282a7be6245c7e7df5db1f83.tar.bz2 kernel-common-3696ee36c993baee282a7be6245c7e7df5db1f83.zip | |
[PATCH] Open IPMI BT overflow
I was looking into random driver code and found a suspicious looking
memcpy() in drivers/char/ipmi/ipmi_bt_sm.c on 2.6.17-rc1:
if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
return -1;
...
memcpy(bt->write_data + 3, data + 1, size - 1);
where sizeof bt->write_data is IPMI_MAX_MSG_LENGTH. It looks like the
memcpy would overflow by 2 bytes if size == IPMI_MAX_MSG_LENGTH. A patch
attached to limit size to (IPMI_MAX_LENGTH - 2).
Cc: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/char/ipmi/ipmi_bt_sm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c index 58dcdee1cd71..0030cd8e2e95 100644 --- a/drivers/char/ipmi/ipmi_bt_sm.c +++ b/drivers/char/ipmi/ipmi_bt_sm.c @@ -165,7 +165,7 @@ static int bt_start_transaction(struct si_sm_data *bt, { unsigned int i; - if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH)) + if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2))) return -1; if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED)) |