openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

char: Int overflow in lp_do_ioctl(). 

arg comes from user-space, so int overflow may occur:
	LP_TIME(minor) = arg * HZ/100;

Reported-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Qixue Xiao <s2exqx@gmail.com>
Signed-off-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yongjian Xu 2013-12-18 15:45:12 +08:00 committed by Greg Kroah-Hartman
parent 138a6d7ea2
commit 1c2de820d6
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/char/lp.c
View File

@ -587,6 +587,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
return -ENODEV; return -ENODEV;
switch ( cmd ) { switch ( cmd ) {
case LPTIME: case LPTIME:
if (arg > UINT_MAX / HZ)
return -EINVAL;
LP_TIME(minor) = arg * HZ/100; LP_TIME(minor) = arg * HZ/100;
break; break;
case LPCHAR: case LPCHAR: