[IA64] Handle count==0 in sn2_ptc_proc_write()

The fix applied in e0c6d97 "security hole in sn2_ptc_proc_write" didn't take into account the case where count==0 (which results in a buffer underrun when adding the trailing '\0'). Thanks to Andi Kleen for pointing this out. Signed-off-by: Cliff Wickman <[email protected]> Signed-off-by: Tony Luck <[email protected]>
ambv · Jun 24, 2008 · 8097110 · 8097110
1 parent 2826f8c
commit 8097110
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -512,7 +512,7 @@ static ssize_t sn2_ptc_proc_write(struct file *file, const char __user *user, si
 	int cpu;
 	char optstr[64];
 
-	if (count > sizeof(optstr))
+	if (count == 0 || count > sizeof(optstr))
 		return -EINVAL;
 	if (copy_from_user(optstr, user, count))
 		return -EFAULT;