Re: [PATCH] toshiba_acpi 0.18

[John Belmonte <john-wanGne27zNesTnJN9+BGXg@public.gmane.org>]

> @@ -499,9 +500,16 @@ write_led(const char *buffer, unsigned l
>  {
>  	int value;
>  	int led_out = 0;
> +	char *tmp_buffer;
>  
> -	if (sscanf(buffer, "%i", &value) == 1)
> +	tmp_buffer = kmalloc(count + 1, GFP_KERNEL);
> +	if (copy_from_user(tmp_buffer, buffer, count))
> +		return -EFAULT;
> +	else
> +		tmp_buffer[count] = '\0';
> +	if (sscanf(tmp_buffer, "%i", &value) == 1)
>  		led_out = value ? 1 : 0;
> +	kfree(tmp_buffer);

Note that if copy_from_user fails, this code leaks memory.

-John


-- 
http:// if  ile.org/


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click