git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a353778) | patch
uml: check length in exitcode_proc_write()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 29 Oct 2013 19:06:04 +0000 (22:06 +0300)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 28 Nov 2013 14:02:06 +0000 (14:02 +0000)
commit02c54b6cf2b7bd1089bef485d7a81bdf0c5999d8
treea866589802c3f487f847c8ef406852916399c058tree | snapshot
parenta3537782a1a2765778cc89ca60dd779eef7092b6commit | diff
uml: check length in exitcode_proc_write()

commit 201f99f170df14ba52ea4c52847779042b7a623b upstream.

We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
arch/um/kernel/exitcode.c diff | blob | history
Pandora Kernel Repository