Jacob von Chorus a46393aba7
staging: gs_fpgaboot: add buffer overflow checks ...
Four fields in struct fpgaimage are char arrays of length MAX_STR (256).
The amount of data read into these buffers is controlled by a length
field in the bitstream file read from userspace. If a corrupt or
malicious firmware file was supplied, kernel data beyond these buffers
can be overwritten arbitrarily.
This patch adds a check of the bitstream's length value to ensure it
fits within the bounds of the allocated buffers. An error condition is
returned from gs_read_bitstream if any of the reads fail.
Signed-off-by: Jacob von Chorus <jacobvonchorus@cwphoto.ca >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2017-07-28 17:07:37 -07:00
2017-07-17 11:43:58 -07:00
2017-07-17 14:44:19 +02:00
2017-07-06 09:41:58 -07:00
2017-07-18 11:37:46 -07:00
2017-07-20 14:56:46 -07:00
2017-07-13 08:03:30 -06:00
2017-07-05 12:31:59 -07:00
2017-07-09 18:48:37 -07:00
2017-06-27 12:13:45 -06:00
2017-07-15 12:44:02 -07:00
2017-07-15 10:59:54 -07:00
2017-07-17 22:43:00 +02:00
2017-07-20 18:57:15 +02:00
2017-07-07 13:55:45 -07:00
2017-07-14 22:49:50 -07:00
2017-07-18 17:49:14 -07:00
2017-07-06 10:17:24 +09:00
2017-07-08 12:36:50 -07:00
2017-07-17 11:56:07 -04:00
2017-06-29 10:37:50 +02:00
2017-06-16 11:48:40 -04:00
2017-07-12 16:26:02 -07:00
2017-07-17 16:13:54 +02:00
2017-07-07 13:30:05 -07:00
2017-07-21 14:04:44 +10:00
2017-07-20 15:45:39 +02:00
2017-07-04 14:28:22 -07:00
2017-07-17 15:00:47 +02:00
2017-07-15 16:38:56 -07:00
2017-07-03 20:55:59 -07:00
2017-07-12 10:04:56 -07:00
2017-07-21 04:37:22 +01:00
2017-06-29 22:58:35 +02:00
2017-07-27 21:29:49 -07:00
2017-07-20 11:24:13 -04:00
2017-07-14 22:53:37 -07:00
2017-07-12 10:00:04 -07:00
2017-07-18 21:59:23 +02:00
2017-07-15 21:25:56 -07:00
2017-07-06 11:32:40 -07:00
2017-07-07 13:17:36 -06:00
2017-07-05 13:13:32 -07:00
2017-07-07 10:24:07 -07:00
2017-07-18 11:51:08 -07:00
2017-07-09 18:48:37 -07:00
2017-07-04 14:47:47 -07:00
2017-07-11 09:55:47 -07:00
2017-07-07 13:55:45 -07:00
2017-07-14 13:10:06 -07:00
2017-07-13 12:07:44 -07:00
2017-07-17 16:38:35 +02:00
2017-07-20 16:33:39 -07:00
2017-07-01 14:30:39 -07:00
2017-07-06 11:30:08 -04:00
2017-07-17 11:43:58 -07:00
2017-07-20 08:41:56 -06:00
2017-07-17 16:15:57 +02:00
2017-07-10 15:23:45 -07:00
2017-07-05 21:46:42 +02:00
2017-07-14 22:24:25 -07:00
2017-06-26 10:54:27 +01:00
2017-06-16 13:22:26 +05:30
2017-07-06 11:38:59 -07:00
2017-07-15 10:59:54 -07:00
2017-07-07 12:40:27 -07:00
2017-07-13 11:47:59 -07:00
2017-06-28 00:38:34 +02:00
2017-07-06 11:40:58 +01:00
2017-07-13 11:49:52 -07:00
2017-07-05 17:09:27 -07:00
2017-07-03 16:52:21 +01:00
2017-06-27 16:21:34 -07:00
2017-07-04 14:47:47 -07:00
2017-07-06 15:38:31 -07:00
2017-07-13 12:15:06 -07:00
2017-07-12 16:26:04 -07:00
2017-06-27 12:13:45 -06:00
2017-07-17 12:26:12 -07:00
2017-07-06 16:24:30 -07:00
2017-07-04 14:47:47 -07:00
2017-07-08 10:41:53 -07:00
2017-07-17 15:00:47 +02:00
2017-07-28 17:07:37 -07:00
2017-07-15 12:44:02 -07:00
2017-07-14 13:12:32 -07:00
2017-07-17 15:55:08 +02:00
2017-07-17 17:04:41 +02:00
2017-07-20 14:40:36 +02:00
2017-07-03 20:27:48 -07:00
2017-07-13 12:23:54 -07:00
2017-07-13 14:27:32 -07:00
2017-07-13 12:38:49 -07:00
2017-06-18 23:13:35 +03:00
2017-07-17 16:48:15 +02:00
2017-07-11 09:59:37 -07:00
2017-07-23 08:13:18 +02:00
a46393aba7