Dan Carpenter <dan.carpen...@oracle.com> writes: > This is called from rsc_parse() with a use controlled value. Say for > example that "gidsetsize" is negative, then we could end up allocating > less than sizeof(struct group_info) leading to memory corruption.
Right now it is the responsibility of the caller of groups_alloc to make certain that gidsetsize is a valid value, and the callers of groups_alloc who know what they are doing already validate this value. Either the pattern of caller validates the messages needs to continue, or groups_alloc needs to be changed and all of the callers need to be updated. Changing groups_alloc for one particular caller is just going to cause maintenance problems. Eric > Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> > --- > I copied the NGROUPS_MAX limit from the surrounding code, I'm not > absolutely that it's the correct limit to use. > > diff --git a/kernel/groups.c b/kernel/groups.c > index 664411f..e9341b3 100644 > --- a/kernel/groups.c > +++ b/kernel/groups.c > @@ -18,6 +18,9 @@ struct group_info *groups_alloc(int gidsetsize) > int nblocks; > int i; > > + if ((unsigned)gidsetsize > NGROUPS_MAX) > + return NULL; > + > nblocks = (gidsetsize + NGROUPS_PER_BLOCK - 1) / NGROUPS_PER_BLOCK; > /* Make sure we always allocate at least one indirect block pointer */ > nblocks = nblocks ? : 1; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
