leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

char: Int overflow in lp_do_ioctl().

Browse Source 
arg comes from user-space, so int overflow may occur:
	LP_TIME(minor) = arg * HZ/100;

Reported-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Qixue Xiao <s2exqx@gmail.com>
Signed-off-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yongjian Xu 2013-12-18 15:45:12 +08:00 committed by Greg Kroah-Hartman
parent 138a6d7ea2
commit 1c2de820d6
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/char/lp.c
View File

@ -587,6 +587,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
return -ENODEV;
switch ( cmd ) {
case LPTIME:
if (arg > UINT_MAX / HZ)
return -EINVAL;
LP_TIME(minor) = arg * HZ/100;
break;
case LPCHAR: