[PATCH] Possible off by one in drivers/parport/probe.c

[Alexander Nyberg]

Hi!

This fixes a theoretical bug indicated in:
http://bugme.osdl.org/show_bug.cgi?id=240

It prevents overflow in case the required buffer is larger than the passed
buffer. This I found to be the minimally intrusive change.

If anyone could test this change using parport with "IEEE 1284 transfer modes"
(CONFIG_PARPORT_1284) hardware it would be nice.


Signed-off-by: Alexander Nyberg <alexn@xxxxxxxxx>

===== drivers/parport/probe.c 1.6 vs edited =====
--- 1.6/drivers/parport/probe.c	2004-10-28 09:39:58 +02:00
+++ edited/drivers/parport/probe.c	2004-12-01 17:02:43 +01:00
@@ -164,8 +164,16 @@ ssize_t parport_device_id (int devnum, c
 		if (retval != 2) goto end_id;
 
 		idlen = (length[0] << 8) + length[1] - 2;
-		if (idlen < len)
+		/* 
+		 * Check if the caller-allocated buffer is large enough
+		 * otherwise bail out or there will be an at least off by one.
+		 */
+		if (idlen + 1 < len)
 			len = idlen;
+		else {
+			retval = -ENOMEM;
+			goto out;
+		}
 		retval = parport_read (dev->port, buffer, len);
 
 		if (retval != len)
@@ -205,11 +213,12 @@ ssize_t parport_device_id (int devnum, c
 		buffer[len] = '\0';
 		parport_negotiate (dev->port, IEEE1284_MODE_COMPAT);
 	}
-	parport_release (dev);
 
 	if (retval > 2)
 		parse_data (dev->port, dev->daisy, buffer);
 
+out:
+	parport_release (dev);
 	parport_close (dev);
 	return retval;
 }


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/