mirror of
https://github.com/torvalds/linux.git
synced 2026-09-18 16:48:03 +02:00
d141f087b1
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
a user-supplied length (udata_len) without checking a lower bound, then
set udata_offset to a fixed non-zero value and pass both to a reply
callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the
subtraction wrap and the check pass, and the following memcpy() writes
past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from
kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the
callback subtraction can no longer underflow.
Fixes:
|
||
|---|---|---|
| .. | ||
| block | ||
| char | ||
| cio | ||
| crypto | ||
| net | ||
| scsi | ||
| virtio | ||
| Makefile | ||