ACPI: Fix bound checks for copy_from_user in the acpi /proc code
The ACPI /proc write() code takes an unsigned length argument like any write() function, but then assigned it to a *signed* integer called "len". Only after this is a sanity check for len done to make it not larger than 4. Due to the type change a len < 0 is in principle also possible; this patch adds a check for this. Signed-off-by:Arjan van de Ven <arjan@linux.intel.com> Signed-off-by:
Len Brown <len.brown@intel.com>
parent
0efe5e32
Please register or sign in to comment