diff options
| author |   Jon Smirl <jonsmirl@gmail.com> | 2005-07-28 21:16:19 -0700 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@g5.osdl.org> | 2005-07-28 21:46:05 -0700 |
| commit | f0b9d796002d9d39575cf1beabfb625f68b507fa (patch) | |
| tree | 185905616555941f578fd0e8b7871477c3395f73 /drivers/video/fbsysfs.c | |
| parent | [PATCH] re-disable TSC on NUMAQ (diff) | |
| download | linux-dev-f0b9d796002d9d39575cf1beabfb625f68b507fa.tar.xz linux-dev-f0b9d796002d9d39575cf1beabfb625f68b507fa.zip | |
[PATCH] fbdev: colormap fixes fix
Fix a buffer overflow vunerabilty in previous cmap patch
Signed-off-by: Jon Smirl <jonsmirl@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/video/fbsysfs.c')
| -rw-r--r-- | drivers/video/fbsysfs.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c index 63b505cce4ec..ed1d4d1ac4f7 100644 --- a/drivers/video/fbsysfs.c +++ b/drivers/video/fbsysfs.c @@ -244,15 +244,15 @@ static ssize_t show_virtual(struct class_device *class_device, char *buf) /* Format for cmap is "%02x%c%4x%4x%4x\n" */ /* %02x entry %c transp %4x red %4x blue %4x green \n */ -/* 255 rows at 16 chars equals 4096 */ -/* PAGE_SIZE can be 4096 or larger */ +/* 256 rows at 16 chars equals 4096, the normal page size */ +/* the code will automatically adjust for different page sizes */ static ssize_t store_cmap(struct class_device *class_device, const char *buf, size_t count) { struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device); int rc, i, start, length, transp = 0; - if ((count > 4096) || ((count % 16) != 0) || (PAGE_SIZE < 4096)) + if ((count > PAGE_SIZE) || ((count % 16) != 0)) return -EINVAL; if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap) @@ -317,18 +317,18 @@ static ssize_t show_cmap(struct class_device *class_device, char *buf) !fb_info->cmap.green) return -EINVAL; - if (PAGE_SIZE < 4096) + if (fb_info->cmap.len > PAGE_SIZE / 16) return -EINVAL; /* don't mess with the format, the buffer is PAGE_SIZE */ - /* 255 entries at 16 chars per line equals 4096 = PAGE_SIZE */ + /* 256 entries at 16 chars per line equals 4096 = PAGE_SIZE */ for (i = 0; i < fb_info->cmap.len; i++) { - sprintf(&buf[ i * 16], "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start, + snprintf(&buf[ i * 16], PAGE_SIZE - i * 16, "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start, ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '), fb_info->cmap.red[i], fb_info->cmap.blue[i], fb_info->cmap.green[i]); } - return 4096; + return 16 * fb_info->cmap.len; } static ssize_t store_blank(struct class_device *class_device, const char * buf, |