Commit 0ddcf3a6 authored Jun 09, 2021 by Hans de Goede

platform/x86: think-lmi: Avoid potential read before start of the buffer



If length equals 0 then reading buf[length-1] will read before the start
of the buffer.

Avoid this by moving the length == 0 check up.

Cc: Mark Pearson <markpearson@lenovo.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210609151752.156902-2-hdegoede@redhat.com

parent 86bb2e3d

drivers/platform/x86/think-lmi.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -443,10 +443,13 @@ static ssize_t kbdlang_store(struct kobject *kobj,
		int length;

		length = strlen(buf);
		if (!length)
		return -EINVAL;

		if (buf[length-1] == '\n')
		length--;

		if (!length \|\| (length >= TLMI_LANG_MAXLEN))
		if (length >= TLMI_LANG_MAXLEN)
		return -EINVAL;

		memcpy(setting->kbdlang, buf, length);