Re: [PATCH v3] platform/chrome: cros_ec_dev - Fix security issue

[Olof Johansson]

On Tue, Mar 08, 2016 at 09:13:52AM -0800, Gwendal Grignou wrote:
> Prevent memory scribble by checking that ioctl buffer size parameters
> are sane.
> Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and
> .outsize the amount to scribble, we would overflow, allocate a small
> amounts and be able to write outside of the malloc'ed area.
> Adding a hard limit allows argument checking of the ioctl. With the
> current EC, it is expected .insize and .outsize to be at around 512 bytes
> or less.
> 
> Signed-off-by: Gwendal Grignou <gwendal@xxxxxxxxxxxx>

Applied now.


-Olof