xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ALSA: asihpi: fix an information leak in asihpi_hpi_ioctl()

Browse Source 
Add missing limits to keep copied data within allocated buffer.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Eliot Blennerhassett <eliot@blennerhassett.gen.nz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Eliot Blennerhassett
2014-12-31 23:48:32 +13:00
committed by Takashi Iwai
parent 240491e143
commit 0d02e12927
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
sound/pci/asihpi/hpi6000.c
View File

@@ -47,7 +47,7 @@
/* operational/messaging errors */
#define HPI6000_ERROR_MSG_RESP_IDLE_TIMEOUT 901
#define HPI6000_ERROR_RESP_GET_LEN 902
#define HPI6000_ERROR_MSG_RESP_GET_RESP_ACK 903
#define HPI6000_ERROR_MSG_GET_ADR 904
#define HPI6000_ERROR_RESP_GET_ADR 905
@@ -1365,7 +1365,10 @@ static short hpi6000_message_response_sequence(struct hpi_adapter_obj *pao,
length = hpi_read_word(pdo, HPI_HIF_ADDR(length));
} while (hpi6000_check_PCI2040_error_flag(pao, H6READ) && --timeout);
if (!timeout)
length = sizeof(struct hpi_response);
return HPI6000_ERROR_RESP_GET_LEN;
if (length > phr->size)
return HPI_ERROR_RESPONSE_BUFFER_TOO_SMALL;
/* get the response */
p_data = (u32 *)phr;