Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1399427
| From | Olof Johansson <olof@lixom.net> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v3] platform/chrome: cros_ec_dev - Fix security issue |
| Date | 2016-05-11 21:10 +0200 |
| Message-ID | <rxHG9-6be-1@gated-at.bofh.it> (permalink) |
| References | <ratiV-3LD-3@gated-at.bofh.it> <ratsB-3P7-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Tue, Mar 08, 2016 at 09:13:52AM -0800, Gwendal Grignou wrote: > Prevent memory scribble by checking that ioctl buffer size parameters > are sane. > Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and > .outsize the amount to scribble, we would overflow, allocate a small > amounts and be able to write outside of the malloc'ed area. > Adding a hard limit allows argument checking of the ioctl. With the > current EC, it is expected .insize and .outsize to be at around 512 bytes > or less. > > Signed-off-by: Gwendal Grignou <gwendal@chromium.org> Applied now. -Olof
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
Re: [PATCH v3] platform/chrome: cros_ec_dev - Fix security issue Olof Johansson <olof@lixom.net> - 2016-05-11 21:10 +0200
csiph-web