fix array overrun check in of_device_64.c
PATCH 1/1 fix array overrun check in of_device_64.c
Do the array length check and fixup before copying the array.
Signed-off-by Robert Reif <[email protected]>
arch/sparc/kernel/of_device_64.c +9 -9
@@ -811,20 +811,20 @@ static struct of_device * __init scan_one_device(struct device_node *dp, irq =of_get_property (dp,"interrupts" , &len);if (irq) { -memcpy (op->irqs, irq, len); op->num_irqs = len /4 ; + +/* Prevent overrunning the op->irqs[] array. */ +if (op->num_irqs >PROMINTR_MAX ) { +printk (KERN_WARNING "%s: Too many irqs (%d), " +"limiting to %d.\n" , + dp->full_name, op->num_irqs,PROMINTR_MAX ); + op->num_irqs =PROMINTR_MAX ; + } +memcpy (op->irqs, irq, op->num_irqs *4 ); }else { op->num_irqs =0 ; } -/* Prevent overrunning the op->irqs[] array. */ -if (op->num_irqs >PROMINTR_MAX ) { -printk (KERN_WARNING "%s: Too many irqs (%d), " -"limiting to %d.\n" , - dp->full_name, op->num_irqs,PROMINTR_MAX ); - op->num_irqs =PROMINTR_MAX ; - } -build_device_resources (op, parent);for (i =0 ; i < op->num_irqs; i++) op->irqs[i] =build_one_device_irq (op, parent, op->irqs[i]);
David Miller
maintainerFrom: Robert Reif <[email protected]>
Date: Mon, 22 Dec 2008 20:11:03 -0500
Quoted 3 lines
Do the array length check and fixup before copying the array.
Signed-off-by Robert Reif <[email protected]>
Good catch! Applied, thanks Robert.