PARISC: led.c - fix potential stack overflow in led_proc_write()

commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.

avoid potential stack overflow by correctly checking count parameter

Reported-by: Ilja <ilja@netric.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Kyle McMartin <kyle@mcmartin.ca>
Cc: James E.J. Bottomley <jejb@parisc-linux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index 9581d3619450d609ca69e305d4fcad7148f9ab93..cc31baa31659782183de1980513265f3882edb31 100644 (file)
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -182,16 +182,18 @@ static int led_proc_read(char *page, char **start, off_t off, int count,
 static int led_proc_write(struct file *file, const char *buf, 
        unsigned long count, void *data)
 {
-       char *cur, lbuf[count + 1];
+       char *cur, lbuf[32];
        int d;
 
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
 
-       memset(lbuf, 0, count + 1);
+       if (count >= sizeof(lbuf))
+               count = sizeof(lbuf)-1;
 
        if (copy_from_user(lbuf, buf, count))
                return -EFAULT;
+       lbuf[count] = 0;
 
        cur = lbuf;