Commit 6b4dbcd8 authored Jul 20, 2009 by Michael Buesch Committed by Helge Deller Aug 02, 2009

parisc: isa-eeprom - Fix loff_t usage



loff_t is a signed type. If userspace passes a negative ppos, the "count"
range check is weakened. "count"s bigger than HPEE_MAX_LENGTH will pass the check.
Also, if ppos is negative, the readb(eisa_eeprom_addr + *ppos) will poke in random
memory.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Cc: stable@kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>

parent 450d6e30

drivers/parisc/eisa_eeprom.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct file * file,
	ssize_t ret;		ssize_t ret;
	int i;		int i;

	if (*ppos >= HPEE_MAX_LENGTH)		if (ppos < 0 \|\| ppos >= HPEE_MAX_LENGTH)
	return 0;		return 0;

	count = ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - ppos;		count = ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - ppos;