braille_console: Read buffer overflow

PATCH In review Roel Kluin 2 participants 2 messages Aug 11, 2009

lore

Share & tools

lore

Roel Kluin

author

2009-08-11 14:32 UTC #0 lore raw

PATCH 1/1 braille_console: Read buffer overflow

Prevent write to console_buf[-1]

Signed-off-by Roel Kluin <[email protected]>

---
If console_newline is true and console_cursor equals WIDTH c is written to console_buf[-1].

drivers/accessibility/braille/braille_console.c +2 -1

index d672cfe..fb4075b 100644
@@ -322,7 +322,8 @@ static int vt_notifier_call(struct notifier_block *blk,
 					(WIDTH-1) * sizeof(*console_buf));
 			else
 				console_cursor++;
-			console_buf[console_cursor-1] = c;
+			if (console_cursor != 0)
+				console_buf[console_cursor-1] = c;
 			break;
 		}
 		if (console_show)

Samuel Thibault

2009-08-11 14:52 UTC #1 lore raw

Quoted 1 line · Roel Kluin, le Tue 11 Aug 2009 16:36:42 +0200, a écrit :

If console_newline is true and console_cursor equals WIDTH

Err, that can never happen since when console_newline is true, console_cursor is reset to 0, then incremented to 1.

Samuel