Skip to contentSkip to conversation

mtd: sanity check input

PATCH Applied Dan Carpenter 2 participants 2 messages Sep 8, 2010 – Sep 13, 2010

Subsystems (2)
Kernel janitors Memory technology devices (MTD)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 mtd: sanity check input

If "ur_idx" is wrong we could go past the end of the array. The "ur_idx" comes from root so it's not a huge deal, but adding a sanity check makes the code more robust.

Signed-off-by Dan Carpenter <[email protected]>
drivers/mtd/mtdchar.c +3 -0
index a825002..9c00549 100644
@@ -513,6 +513,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
 		if (get_user(ur_idx, &(ur->regionindex)))
 			return -EFAULT;
 
+		if (ur_idx >= mtd->numeraseregions)
+			return -EINVAL;
+
 		kr = &(mtd->eraseregions[ur_idx]);
 
 		if (put_user(kr->offset, &(ur->offset))
Applied
#1 lore raw
Quoted 11 lines · Dan Carpenter

If "ur_idx" is wrong we could go past the end of the array. The "ur_idx" comes from root so it's not a huge deal, but adding a sanity check makes the code more robust.

Signed-off-by Dan Carpenter <[email protected]>
drivers/mtd/mtdchar.c +0 -0
index a825002..9c00549 100644

drivers/mtd/mtdchar.c static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) · line 518

Quoted 6 lines
drivers/mtd/mtdchar.c +3 -0
@@ -513,6 +513,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
 		if (get_user(ur_idx, &(ur->regionindex)))
 			return -EFAULT;
 
+		if (ur_idx >= mtd->numeraseregions)
+			return -EINVAL;
+

Pushed to l2-mtd-2.6.git with my "Signed-off-by", thanks.

Signature · 2 lines
Best Regards,
Artem Bityutskiy (Артём Битюцкий)