Commit 2665bef4 authored by Jiri Slaby's avatar Jiri Slaby Committed by Greg Kroah-Hartman
Browse files

vc_screen: sanitize types in vcs_write 



* ret can carry error codes, so make it signed, i.e. ssize_t
* pos is derived from the passed ppos, so make it long enough, i.e.
  loff_t
* attr is a boolean, so...
* size is limited by vcs_size() which returns an int
* written, p, orig_count and this_round are always ">= 0" and "< size",
  so uint is enough
* col and max_col are derived from vc->vc_cols (uint) and p, so make
  them uint too
* place con_buf0 and con_buf declaration to a single line

Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200818085706.12163-6-jslaby@suse.cz


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 71d4abfa

drivers/tty/vt/vc_screen.c

+7 −10
Original line number Diff line number Diff line
@@ -459,14 +459,13 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) 
{

	struct inode *inode = file_inode(file);

	struct vc_data *vc;

	long pos;

	long attr, size, written;

	char *con_buf0;

	int col, maxcol;

	char *con_buf0, *con_buf;

	u16 *org0 = NULL, *org = NULL;

	size_t ret;

	char *con_buf;

	bool viewed;

	unsigned int written, col, maxcol;

	int size;

	ssize_t ret;

	loff_t pos;

	bool viewed, attr;



	if (use_unicode(inode))

		return -EOPNOTSUPP;
@@ -500,9 +499,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) 
		count = size - pos;

	written = 0;

	while (count) {

		long this_round = count;

		size_t orig_count;

		long p;

		unsigned int orig_count, p, this_round = count;



		if (this_round > CON_BUF_SIZE)

			this_round = CON_BUF_SIZE;

CRA Git | Maintained and supported by SUSTech CRA and CCSE