Re: Misc 2.5 Fixes: cp-user-zoran

Dipankar Sarma
2003-06-10T10:09:10Z

Use copy_to_user/put_user with user buffers.

drivers/media/video/zoran_procfs.c | 6 +++++-
drivers/media/video/zr36120.c | 12 ++++++------
2 files changed, 11 insertions(+), 7 deletions(-)

diff -puN drivers/media/video/zoran_procfs.c~cp-user-zoran drivers/media/video/zoran_procfs.c
--- linux-2.5.70-ds/drivers/media/video/zoran_procfs.c~cp-user-zoran 2003-06-08 04:10:38.000000000 +0530
+++ linux-2.5.70-ds-dipankar/drivers/media/video/zoran_procfs.c 2003-06-08 04:10:38.000000000 +0530
@@ -119,7 +119,11 @@ static int zoran_write_proc(struct file
printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name);
return -ENOMEM;
}
- memcpy(string, buffer, count);
+ if(copy_from_user(string, buffer, count))
+ {
+ vfree(string);
+ return -EFAULT;
+ }
string[count] = 0;
DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data));
ldelim = " \t\n";
diff -puN drivers/media/video/zr36120.c~cp-user-zoran drivers/media/video/zr36120.c
--- linux-2.5.70-ds/drivers/media/video/zr36120.c~cp-user-zoran 2003-06-08 04:10:38.000000000 +0530
+++ linux-2.5.70-ds-dipankar/drivers/media/video/zr36120.c 2003-06-08 04:10:38.000000000 +0530
@@ -1693,12 +1693,12 @@ long vbi_read(struct video_device* dev,
for (x=0; optr+1<eptr && x<-done->w; x++)
{
unsigned char a = iptr[x*2];
- *optr++ = a;
- *optr++ = a;
+ __put_user(a, optr++);
+ __put_user(a, optr++);
}
/* and clear the rest of the line */
for (x*=2; optr<eptr && x<done->bpl; x++)
- *optr++ = 0;
+ __put_user(0, optr++);
/* next line */
iptr += done->bpl;
}
@@ -1715,10 +1715,10 @@ long vbi_read(struct video_device* dev,
{
/* copy to doubled data to userland */
for (x=0; optr<eptr && x<-done->w; x++)
- *optr++ = iptr[x*2];
+ __put_user(iptr[x*2], optr++);
/* and clear the rest of the line */
for (;optr<eptr && x<done->bpl; x++)
- *optr++ = 0;
+ __put_user(0, optr++);
/* next line */
iptr += done->bpl;
}
@@ -1727,7 +1727,7 @@ long vbi_read(struct video_device* dev,
/* API compliance:
* place the framenumber (half fieldnr) in the last long
*/
- ((ulong*)eptr)[-1] = done->fieldnr/2;
+ __put_user(done->fieldnr/2, ((ulong*)eptr)-1);
}

/* keep the engine running */

_