diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-04-13 10:37:44 +0300 |
|---|---|---|
| committer | Hans de Goede <hdegoede@redhat.com> | 2022-04-27 16:25:24 +0200 |
| commit | d2833762f23a62cce1636452108706541a735290 (patch) | |
| tree | feadc07440cf01729b81cade7c621621d5cc85ed | |
| parent | acd51562e07d17aaf4ac652f1dc55c743685bf41 (diff) | |
| download | linux-d2833762f23a62cce1636452108706541a735290.tar.gz linux-d2833762f23a62cce1636452108706541a735290.tar.bz2 linux-d2833762f23a62cce1636452108706541a735290.zip | |
platform/x86: asus-wmi: Potential buffer overflow in asus_wmi_evaluate_method_buf()
This code tests for if the obj->buffer.length is larger than the buffer
but then it just does the memcpy() anyway.
Fixes: 0f0ac158d28f ("platform/x86: asus-wmi: Add support for custom fan curves")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220413073744.GB8812@kili
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
| -rw-r--r-- | drivers/platform/x86/asus-wmi.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c index 2104a2621e50..7e3c0a8e3997 100644 --- a/drivers/platform/x86/asus-wmi.c +++ b/drivers/platform/x86/asus-wmi.c @@ -371,10 +371,14 @@ static int asus_wmi_evaluate_method_buf(u32 method_id, switch (obj->type) { case ACPI_TYPE_BUFFER: - if (obj->buffer.length > size) + if (obj->buffer.length > size) { err = -ENOSPC; - if (obj->buffer.length == 0) + break; + } + if (obj->buffer.length == 0) { err = -ENODATA; + break; + } memcpy(ret_buffer, obj->buffer.pointer, obj->buffer.length); break; |