Skip to content
Commit f118e9ab authored by Chen Gang's avatar Chen Gang Committed by David S. Miller
Browse files

arch: sparc: kernel: check the memory length before use strcpy().



For the related next strcpy(), the destination length is less than 512,
but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
more than 512.

One work flow may:
  openprom_sunos_ioctl() ->  if (cmd == OPROMSETOPT)
    getstrings() ->  will alloc buffer with size 'OPROMMAXPARAM'.
    opromsetopt() ->  devide the buffer into 'var' and 'value'
      of_set_property() -> pass
        prom_setprop() -> pass
          ldom_set_var()

And do not mind the additional 4 alignment buffer increasing, since
'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.

Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bfffbea1
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment