gpib: lpvo_usb_gpib: fix heap buffer overflow in lpvo_do_write()

[PATCH] gpib: lpvo_usb_gpib: fix heap buffer overflow in lpvo_do_write()

Aditya posted 1 patch 4 weeks, 1 day ago

Download mbox

drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] gpib: lpvo_usb_gpib: fix heap buffer overflow in lpvo_do_write()

Posted by Aditya 4 weeks, 1 day ago

The memcpy in lpvo_do_write() uses the original unbounded 'count' parameter instead of the capped 'writesize', causing a heap buffer overflow when a user writes more than MAX_TRANSFER (3584 bytes) to /dev/lpvo_raw%d.

Fix by using 'writesize' which is already capped to MAX_TRANSFER.

Cc: stable@vger.kernel.org
Signed-off-by: Aditya <mail4adityaa@gmail.com>
---
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c b/drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c
index e6ea9422d6f2..ff7cef08031d 100644
--- a/drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c
+++ b/drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c
@@ -1638,7 +1638,7 @@ static ssize_t lpvo_do_write(struct lpvo *dev, const char *buffer, size_t count)
 		goto error;
 	}
 
-	memcpy(buf, buffer, count);
+	memcpy(buf, buffer, writesize);
 
 	/* this lock makes sure we don't submit URBs to gone devices */
 	mutex_lock(&dev->io_mutex);
-- 
2.43.0