tree 185905616555941f578fd0e8b7871477c3395f73
parent e1474e2d9dfb782e6c6517a180b5a8913c69dfad
author Jon Smirl <[EMAIL PROTECTED]> Fri, 29 Jul 2005 11:16:19 -0700
committer Linus Torvalds <[EMAIL PROTECTED]> Fri, 29 Jul 2005 11:46:05 -0700
[PATCH] fbdev: colormap fixes fix
Fix a buffer overflow vunerabilty in previous cmap patch
Signed-off-by: Jon Smirl <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
drivers/video/fbsysfs.c | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -244,15 +244,15 @@ static ssize_t show_virtual(struct class
/* Format for cmap is "%02x%c%4x%4x%4x\n" */
/* %02x entry %c transp %4x red %4x blue %4x green \n */
-/* 255 rows at 16 chars equals 4096 */
-/* PAGE_SIZE can be 4096 or larger */
+/* 256 rows at 16 chars equals 4096, the normal page size */
+/* the code will automatically adjust for different page sizes */
static ssize_t store_cmap(struct class_device *class_device, const char *buf,
size_t count)
{
struct fb_info *fb_info = (struct fb_info
*)class_get_devdata(class_device);
int rc, i, start, length, transp = 0;
- if ((count > 4096) || ((count % 16) != 0) || (PAGE_SIZE < 4096))
+ if ((count > PAGE_SIZE) || ((count % 16) != 0))
return -EINVAL;
if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap)
@@ -317,18 +317,18 @@ static ssize_t show_cmap(struct class_de
!fb_info->cmap.green)
return -EINVAL;
- if (PAGE_SIZE < 4096)
+ if (fb_info->cmap.len > PAGE_SIZE / 16)
return -EINVAL;
/* don't mess with the format, the buffer is PAGE_SIZE */
- /* 255 entries at 16 chars per line equals 4096 = PAGE_SIZE */
+ /* 256 entries at 16 chars per line equals 4096 = PAGE_SIZE */
for (i = 0; i < fb_info->cmap.len; i++) {
- sprintf(&buf[ i * 16], "%02x%c%4x%4x%4x\n", i +
fb_info->cmap.start,
+ snprintf(&buf[ i * 16], PAGE_SIZE - i * 16,
"%02x%c%4x%4x%4x\n", i + fb_info->cmap.start,
((fb_info->cmap.transp && fb_info->cmap.transp[i]) ?
'*' : ' '),
fb_info->cmap.red[i], fb_info->cmap.blue[i],
fb_info->cmap.green[i]);
}
- return 4096;
+ return 16 * fb_info->cmap.len;
}
static ssize_t store_blank(struct class_device *class_device, const char * buf,
-
To unsubscribe from this list: send the line "unsubscribe bk-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
