aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/video
diff options
context:
space:
mode:
authorJon Smirl <jonsmirl@gmail.com>2005-07-29 00:16:19 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-07-29 00:46:05 -0400
commitf0b9d796002d9d39575cf1beabfb625f68b507fa (patch)
tree185905616555941f578fd0e8b7871477c3395f73 /drivers/video
parente1474e2d9dfb782e6c6517a180b5a8913c69dfad (diff)
[PATCH] fbdev: colormap fixes fix
Fix a buffer overflow vunerabilty in previous cmap patch Signed-off-by: Jon Smirl <jonsmirl@gmail.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/fbsysfs.c14
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index 63b505cce4ec..ed1d4d1ac4f7 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -244,15 +244,15 @@ static ssize_t show_virtual(struct class_device *class_device, char *buf)
244 244
245/* Format for cmap is "%02x%c%4x%4x%4x\n" */ 245/* Format for cmap is "%02x%c%4x%4x%4x\n" */
246/* %02x entry %c transp %4x red %4x blue %4x green \n */ 246/* %02x entry %c transp %4x red %4x blue %4x green \n */
247/* 255 rows at 16 chars equals 4096 */ 247/* 256 rows at 16 chars equals 4096, the normal page size */
248/* PAGE_SIZE can be 4096 or larger */ 248/* the code will automatically adjust for different page sizes */
249static ssize_t store_cmap(struct class_device *class_device, const char *buf, 249static ssize_t store_cmap(struct class_device *class_device, const char *buf,
250 size_t count) 250 size_t count)
251{ 251{
252 struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device); 252 struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device);
253 int rc, i, start, length, transp = 0; 253 int rc, i, start, length, transp = 0;
254 254
255 if ((count > 4096) || ((count % 16) != 0) || (PAGE_SIZE < 4096)) 255 if ((count > PAGE_SIZE) || ((count % 16) != 0))
256 return -EINVAL; 256 return -EINVAL;
257 257
258 if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap) 258 if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap)
@@ -317,18 +317,18 @@ static ssize_t show_cmap(struct class_device *class_device, char *buf)
317 !fb_info->cmap.green) 317 !fb_info->cmap.green)
318 return -EINVAL; 318 return -EINVAL;
319 319
320 if (PAGE_SIZE < 4096) 320 if (fb_info->cmap.len > PAGE_SIZE / 16)
321 return -EINVAL; 321 return -EINVAL;
322 322
323 /* don't mess with the format, the buffer is PAGE_SIZE */ 323 /* don't mess with the format, the buffer is PAGE_SIZE */
324 /* 255 entries at 16 chars per line equals 4096 = PAGE_SIZE */ 324 /* 256 entries at 16 chars per line equals 4096 = PAGE_SIZE */
325 for (i = 0; i < fb_info->cmap.len; i++) { 325 for (i = 0; i < fb_info->cmap.len; i++) {
326 sprintf(&buf[ i * 16], "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start, 326 snprintf(&buf[ i * 16], PAGE_SIZE - i * 16, "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start,
327 ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '), 327 ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '),
328 fb_info->cmap.red[i], fb_info->cmap.blue[i], 328 fb_info->cmap.red[i], fb_info->cmap.blue[i],
329 fb_info->cmap.green[i]); 329 fb_info->cmap.green[i]);
330 } 330 }
331 return 4096; 331 return 16 * fb_info->cmap.len;
332} 332}
333 333
334static ssize_t store_blank(struct class_device *class_device, const char * buf, 334static ssize_t store_blank(struct class_device *class_device, const char * buf,