evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dwc3: debugfs: Add check for length before copy data from userspace

Browse source 
Add boundary check before copying data from userspace buffer to dwc3
local buffer. The third parameter passed to copy_from_user() should be
minimum of the two values between userpsace buffer size count and
(local_buffer size - 1). The last one byte in local_buffer should be
reserved for null terminator.

Change-Id: I9b2e3db4d5ad6b5f14515cadafa6264f9e8b786c
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
This commit is contained in:
Vijayavardhan Vennapusa 2018-01-16 14:51:15 +05:30
parent de111ce20e
commit 54e88e72a6
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/usb/dwc3/debugfs.c
View file

@ -633,7 +633,7 @@ static ssize_t dwc3_store_ep_num(struct file *file, const char __user *ubuf,
unsigned int num, dir, temp;
unsigned long flags;
if (copy_from_user(kbuf, ubuf, count > 10 ? 10 : count))
if (copy_from_user(kbuf, ubuf, min_t(size_t, sizeof(kbuf) - 1, count)))
return -EFAULT;
if (sscanf(kbuf, "%u %u", &num, &dir) != 2)