Staging: gdm72xx: underflow bug in gdm_wimax_ioctl_get_data()

PATCH New Dan Carpenter 1 participant 1 message Feb 22, 2016

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2016-02-22 19:33 UTC #0 lore raw

PATCH 5/6 Staging: gdm72xx: underflow bug in gdm_wimax_ioctl_get_data()

"size" here should be unsigned, otherwise we might end up trying to copy negative bytes in gdm_wimax_ioctl_get_data() resulting in an information leak.

Reported-by Alan Cox <[email protected]>

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/gdm72xx/wm_ioctl.h +2 -2

index 631cb1d..032cb07 100644
@@ -74,12 +74,12 @@ struct fsm_s {
 };
 
 struct data_s {
-	int	size;
+	unsigned int size;
 	void	*buf;
 };
 
 struct udata_s {
-	int		size;
+	unsigned int	size;
 	void __user	*buf;
 };