Commit e0aa762c authored Feb 22, 2016 by Dan Carpenter Committed by Greg Kroah-Hartman Mar 05, 2016

Staging: gdm72xx: underflow bug in gdm_wimax_ioctl_get_data()



"size" here should be unsigned, otherwise we might end up trying to copy
negative bytes in gdm_wimax_ioctl_get_data() resulting in an information
leak.

Reported-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent deb0b53b

drivers/staging/gdm72xx/wm_ioctl.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -74,12 +74,12 @@ struct fsm_s {
		};

		struct data_s {
		int size;
		unsigned int size;
		void *buf;
		};

		struct udata_s {
		int size;
		unsigned int size;
		void __user *buf;
		};

Admin message