[IA64] SN2: security hole in sn2_ptc_proc_write

Security hole in sn2_ptc_proc_write It is possible to overrun a buffer with a write to this /proc file. Signed-off-by: Cliff Wickman <[email protected]> Signed-off-by: Tony Luck <[email protected]>
mna · Jun 20, 2008 · e0c6d97 · e0c6d97
1 parent 9bedbcb
commit e0c6d97
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -512,6 +512,8 @@ static ssize_t sn2_ptc_proc_write(struct file *file, const char __user *user, si
 	int cpu;
 	char optstr[64];
 
+	if (count > sizeof(optstr))
+		return -EINVAL;
 	if (copy_from_user(optstr, user, count))
 		return -EFAULT;
 	optstr[count - 1] = '\0';