]> pilppa.com Git - linux-2.6-omap-h63xx.git/commitdiff
[PATCH] firmware/dcdbas: add size check in smi_data_write
authorDoug Warzecha <Douglas_Warzecha@dell.com>
Fri, 20 Oct 2006 06:29:09 +0000 (23:29 -0700)
committerLinus Torvalds <torvalds@g5.osdl.org>
Fri, 20 Oct 2006 17:26:44 +0000 (10:26 -0700)
Add a size check in smi_data_write to prevent possible wrapping problems
with large pos values when calling smi_data_buf_realloc on 32-bit.

Signed-off-by: Doug Warzecha <Douglas_Warzecha@dell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
drivers/firmware/dcdbas.c

index 8bcb58cd4ac0f93daf7b4bdc3924e2ef4caa2e2a..1865b56fb141643878b50b4874c4be56f612ff0c 100644 (file)
@@ -8,7 +8,7 @@
  *
  *  See Documentation/dcdbas.txt for more information.
  *
- *  Copyright (C) 1995-2005 Dell Inc.
+ *  Copyright (C) 1995-2006 Dell Inc.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License v2.0 as published by
@@ -40,7 +40,7 @@
 #include "dcdbas.h"
 
 #define DRIVER_NAME            "dcdbas"
-#define DRIVER_VERSION         "5.6.0-2"
+#define DRIVER_VERSION         "5.6.0-3.2"
 #define DRIVER_DESCRIPTION     "Dell Systems Management Base Driver"
 
 static struct platform_device *dcdbas_pdev;
@@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos,
 {
        ssize_t ret;
 
+       if ((pos + count) > MAX_SMI_DATA_BUF_SIZE)
+               return -EINVAL;
+
        mutex_lock(&smi_data_lock);
 
        ret = smi_data_buf_realloc(pos + count);