lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[PATCH] fbdev: colormap fixes fix

Browse Source 
Fix a buffer overflow vunerabilty in previous cmap patch

Signed-off-by: Jon Smirl <jonsmirl@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Jon Smirl
2005-07-28 21:16:19 -07:00
committed by Linus Torvalds
parent e1474e2d9d
commit f0b9d79600
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/video/fbsysfs.c
View File

@@ -244,15 +244,15 @@ static ssize_t show_virtual(struct class_device *class_device, char *buf)
/* Format for cmap is "%02x%c%4x%4x%4x\n" */ /* Format for cmap is "%02x%c%4x%4x%4x\n" */
/* %02x entry %c transp %4x red %4x blue %4x green \n */ /* %02x entry %c transp %4x red %4x blue %4x green \n */
/* 255 rows at 16 chars equals 4096 */ /* 256 rows at 16 chars equals 4096, the normal page size */
/* PAGE_SIZE can be 4096 or larger */ /* the code will automatically adjust for different page sizes */
static ssize_t store_cmap(struct class_device *class_device, const char *buf, static ssize_t store_cmap(struct class_device *class_device, const char *buf,
size_t count) size_t count)
{ {
struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device); struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device);
int rc, i, start, length, transp = 0; int rc, i, start, length, transp = 0;
if ((count > 4096) || ((count % 16) != 0) || (PAGE_SIZE < 4096)) if ((count > PAGE_SIZE) || ((count % 16) != 0))
return -EINVAL; return -EINVAL;
if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap) if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap)
@@ -317,18 +317,18 @@ static ssize_t show_cmap(struct class_device *class_device, char *buf)
!fb_info->cmap.green) !fb_info->cmap.green)
return -EINVAL; return -EINVAL;
if (PAGE_SIZE < 4096) if (fb_info->cmap.len > PAGE_SIZE / 16)
return -EINVAL; return -EINVAL;
/* don't mess with the format, the buffer is PAGE_SIZE */ /* don't mess with the format, the buffer is PAGE_SIZE */
/* 255 entries at 16 chars per line equals 4096 = PAGE_SIZE */ /* 256 entries at 16 chars per line equals 4096 = PAGE_SIZE */
for (i = 0; i < fb_info->cmap.len; i++) { for (i = 0; i < fb_info->cmap.len; i++) {
sprintf(&buf[ i * 16], "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start, snprintf(&buf[ i * 16], PAGE_SIZE - i * 16, "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start,
((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '), ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '),
fb_info->cmap.red[i], fb_info->cmap.blue[i], fb_info->cmap.red[i], fb_info->cmap.blue[i],
fb_info->cmap.green[i]); fb_info->cmap.green[i]);
} }
return 4096; return 16 * fb_info->cmap.len;
} }
static ssize_t store_blank(struct class_device *class_device, const char * buf, static ssize_t store_blank(struct class_device *class_device, const char * buf,