Commit 56df900c authored Jun 16, 2015 by Jes Sorensen Committed by Greg Kroah-Hartman Jun 16, 2015

staging: unisys: visorchannel_write() fix potential memory corruption



This fixes the memory corruption case, if nbytes is less than offset
and sizeof(struct channel_header)

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Benjamin Romer <benjamin.romer@unisys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 68905a14

drivers/staging/unisys/visorbus/visorchannel.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -258,7 +258,7 @@ visorchannel_write(struct visorchannel *channel, ulong offset,
		return -EIO;

		if (offset < chdr_size) {
		copy_size = min(chdr_size, nbytes) - offset;
		copy_size = min(chdr_size - offset, nbytes);
		memcpy(&channel->chan_hdr + offset, local, copy_size);
		}

Admin message