Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 13996ca7 authored by Chen Gang's avatar Chen Gang Committed by Greg Kroah-Hartman
Browse files

USB: uhci: check buffer length to avoid memory overflow



  for function uhci_sprint_schedule:
    the buffer len is MAX_OUTPUT: 64 * 1024, which may not be enough:
      may loop UHCI_NUMFRAMES times (UHCI_NUMFRAMES is 1024)
      each time of loop may get more than 64 bytes
    so need check the buffer length to avoid memory overflow

  this patch fix it like this:
    at first, make enough room for buffering the exceeding contents
    judge the contents which written whether bigger than buffer length
    if bigger (the exceeding contents will be in the exceeding buffer)
      break current work flow, and return.

Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d2123fd9
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment