diff options
| author | yang-cy.chen <yang-cy.chen@mediatek.com> | 2016-05-05 20:27:55 +0800 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2016-08-26 16:02:14 +0200 |
| commit | 7c6ae0e9fe2f82b13bb751143feb933a83a96ac3 (patch) | |
| tree | 4b5f3109279a11a525619d07265e93437951a379 | |
| parent | 2ba773c9c6498be7623d3de43f825aef48dd619d (diff) | |
Fix "stack overflow in Mediatek Thermal driver" issue
Problem:
lack of boundary check of user input parameter before copy_from_user.
Solution:
Add boundary protection to prevent buffer overflow
Bug num:28333002
Change-Id: I8364a6cbf69527d4b2f2fa7874c8c01720febd5d
Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
| -rw-r--r-- | drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c b/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c index 7f5beb898..dc5fe0a0e 100644 --- a/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c +++ b/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c @@ -64,6 +64,9 @@ static ssize_t _mtk_cl_sd_rst_write(struct file *filp, const char __user *buf, s int ret = 0; char tmp[MAX_LEN] = { 0 }; + + len = min(len,MAX_LEN-1); + /* write data to the buffer */ if (copy_from_user(tmp, buf, len)) { return -EFAULT; |