mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-14 15:55:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

greybus: validate descriptor sizes

Browse Source 
When interpreting a manifest descriptor header, don't assume there
is enough space in the buffer to hold a descriptor header.  Also,
verify the remaining buffer is at least as big as the reported
descriptor size.

Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Alex Elder
2014-09-09 13:55:08 -05:00
committed by Greg Kroah-Hartman
parent a22e15a1fc
commit 57fc0a1104
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/staging/greybus/core.c
View File

@@ -395,8 +395,17 @@ struct greybus_device *greybus_new_module(struct device *parent,
size -= sizeof(manifest->header);
data += sizeof(manifest->header);
while (size > 0) {
if (size < sizeof(desc->header)) {
dev_err(parent, "remaining size %d too small\n", size);
goto error;
}
desc = (struct greybus_descriptor *)data;
desc_size = le16_to_cpu(desc->header.size);
if (size < desc_size) {
dev_err(parent, "descriptor size %d too big\n",
desc_size);
goto error;
}
switch (le16_to_cpu(desc->header.type)) {
case GREYBUS_TYPE_FUNCTION: