diff options
| author | yang-cy.chen <yang-cy.chen@mediatek.com> | 2016-05-05 20:08:15 +0800 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2016-11-07 13:46:49 +0100 |
| commit | ac91a154f58f4902c9c16a5b95cf9dd791e56e2e (patch) | |
| tree | 08ea04a54a577db50482d8a6ce60adc5d0fe2934 | |
| parent | 7eb9f26b811bf92d852fe83bbcd8fe8befb9b5b6 (diff) | |
Fix "stack overflow in Mediatek Thermal driver" issue
Problem:
lack of boundary check of user input parameter before copy_from_user.
Solution:
Add boundary protection to prevent buffer overflow
Bug num:28332766
Change-Id: I8536ae241070e59fbb15449bd3bca00d895e0b3f
Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
Ticket: PORRIDGE-398
| -rw-r--r-- | drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c b/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c index a56e90004..2997a5446 100644 --- a/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c +++ b/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c @@ -891,6 +891,9 @@ ssize_t wmt_wifi_algo_write(struct file *filp, const char __user *buf, size_t le len = (len < (sizeof(desc) - 1)) ? len : (sizeof(desc) - 1); + if (len >= MAX_LEN-1) + len = MAX_LEN-1; + /* write data to the buffer */ if (copy_from_user(desc, buf, len)) { return -EFAULT; |