Re: toshiba_acpi 0.18

[Sergey Vlasov <vsu-u2l5PoMzF/Uox3rIn2DAYQ@public.gmane.org>]

[-- Attachment #1: Type: text/plain, Size: 999 bytes --]

On Sun, 14 Mar 2004 01:02:58 -0500 John Belmonte wrote:

>  static int
> -dispatch_write(struct file* file, const char* buffer, unsigned long count,
> -	ProcItem* item)
> +dispatch_write(struct file* file, __user const char* buffer,
> +	unsigned long count, ProcItem* item)
>  {
> -	return item->write_func(buffer, count);
> +	int result;
> +	char* tmp_buffer;
> +
> +	/* Arg buffer points to userspace memory, which can't be accessed
> +	 * directly.  Since we're making a copy, zero-terminate the
> +	 * destination so that sscanf can be used on it safely.
> +	 */
> +	tmp_buffer = kmalloc(count + 1, GFP_KERNEL);
> +	if (copy_from_user(tmp_buffer, buffer, count)) {
> +		result = -EFAULT;
> +	}
> +	else {
> +		tmp_buffer[count] = 0;
> +		result = item->write_func(tmp_buffer, count);
> +	}
> +	kfree(tmp_buffer);
> +	return result;
>  }

This is still not enough.  count comes from userspace and can be
arbitrarily large, and this function does not even check the return
value from kmalloc()...

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]