tpm, tpm_tis: potential underflow bug in tpm_tis_recv()

PATCH New Dan Carpenter 1 participant 1 message Mar 24, 2015

Subsystems (2)

Kernel janitors TPM device driver

lore

Share & tools

lore

Dan Carpenter

author

2015-03-24 09:19 UTC #0 lore raw

PATCH 1/2 tpm, tpm_tis: potential underflow bug in tpm_tis_recv()

If "expected" is less than TPM_HEADER_SIZE (10) then it could mean we try to read a negative number of bytes.

Signed-off-by Dan Carpenter <[email protected]>

drivers/char/tpm/tpm_tis.c +1 -1

index f2dffa7..aa96ecd 100644
@@ -258,7 +258,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 	}
 
 	expected = be32_to_cpu(*(__be32 *) (buf + 2));
-	if (expected > count) {
+	if (expected < TPM_HEADER_SIZE || expected > count) {
 		size = -EIO;
 		goto out;
 	}