* [CHECKER] [PATCH] zortran user-pointer fix
@ 2003-05-27 18:05 Hollis Blanchard
0 siblings, 0 replies; only message in thread
From: Hollis Blanchard @ 2003-05-27 18:05 UTC (permalink / raw)
To: linux-kernel
[-- Attachment #1: Type: text/plain, Size: 868 bytes --]
Here's what the Stanford checker said:
---------------------------------------------------------
[BUG] proc_dir_entry.write_proc
/home/junfeng/linux-2.5.63/drivers/media/video/
zoran_procfs.c:122:zoran_write_proc:
ERROR:TAINTED:122:122: passing tainted ptr 'buffer' to __memcpy
[Callstack:
/home/junfeng/linux-2.5.63/net/core/
pktgen.c:991:zoran_write_proc((tainted
1))]
string = sp = vmalloc(count + 1);
if (!string) {
printk(KERN_ERR "%s: write_proc: can not allocate
memory\n", zr->name);
return -ENOMEM;
}
Error --->
memcpy(string, buffer, count);
string[count] = 0;
DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu
data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data));
ldelim = " \t\n";
---------------------------------------------------------
Is this patch correct?
--
Hollis Blanchard
IBM Linux Technology Center
[-- Attachment #2: zortan-memcpy.diff --]
[-- Type: application/octet-stream, Size: 595 bytes --]
--- linux-2.5.69/drivers/media/video/zoran_procfs.c.orig 2003-05-23 15:42:18.000000000 -0500
+++ linux-2.5.69/drivers/media/video/zoran_procfs.c 2003-05-23 15:42:40.000000000 -0500
@@ -119,7 +119,10 @@
printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name);
return -ENOMEM;
}
- memcpy(string, buffer, count);
+ if (copy_from_user(string, buffer, count)) {
+ vfree(string);
+ return -EFAULT;
+ }
string[count] = 0;
DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data));
ldelim = " \t\n";
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2003-05-27 17:54 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-05-27 18:05 [CHECKER] [PATCH] zortran user-pointer fix Hollis Blanchard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).