diff options
| author | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2010-11-01 13:59:01 -0400 |
|---|---|---|
| committer | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2010-11-01 13:59:01 -0400 |
| commit | 9c5d77009db6ff09d02a7b0a99a70c0dfd3af6c6 (patch) | |
| tree | a75934a9d0b541b0688e224df144aa0bce3034cd /drivers/staging/bcm | |
| parent | 5cf084f44ac24189ef3373010da49e26d651aa06 (diff) | |
| download | linux-9c5d77009db6ff09d02a7b0a99a70c0dfd3af6c6.tar.gz linux-9c5d77009db6ff09d02a7b0a99a70c0dfd3af6c6.tar.bz2 linux-9c5d77009db6ff09d02a7b0a99a70c0dfd3af6c6.zip | |
beceem: don't overrun user buffer on read
Serious bug in original code, if app reads 10 bytes but 20 byte msg
received memory would get overwritten.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Diffstat (limited to 'drivers/staging/bcm')
| -rw-r--r-- | drivers/staging/bcm/Bcmchar.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 1a255609aeda..8089d19e6c1b 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -139,7 +139,7 @@ static ssize_t bcm_char_read(struct file *filp, char __user *buf, size_t size, l if(Packet) { PktLen = Packet->len; - if(copy_to_user(buf, Packet->data, PktLen)) + if(copy_to_user(buf, Packet->data, min_t(size_t, PktLen, size))) { dev_kfree_skb(Packet); BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0, "\nReturning from copy to user failure \n"); |