| From: Willy Tarreau <w@1wt.eu> |
| Date: Tue, 16 May 2017 19:18:55 +0200 |
| Subject: char: lp: fix possible integer overflow in lp_setup() |
| |
| commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 upstream. |
| |
| The lp_setup() code doesn't apply any bounds checking when passing |
| "lp=none", and only in this case, resulting in an overflow of the |
| parport_nr[] array. All versions in Git history are affected. |
| |
| Reported-By: Roee Hay <roee.hay@hcl.com> |
| Cc: Ben Hutchings <ben@decadent.org.uk> |
| Signed-off-by: Willy Tarreau <w@1wt.eu> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/char/lp.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/char/lp.c |
| +++ b/drivers/char/lp.c |
| @@ -858,7 +858,11 @@ static int __init lp_setup (char *str) |
| } else if (!strcmp(str, "auto")) { |
| parport_nr[0] = LP_PARPORT_AUTO; |
| } else if (!strcmp(str, "none")) { |
| - parport_nr[parport_ptr++] = LP_PARPORT_NONE; |
| + if (parport_ptr < LP_NO) |
| + parport_nr[parport_ptr++] = LP_PARPORT_NONE; |
| + else |
| + printk(KERN_INFO "lp: too many ports, %s ignored.\n", |
| + str); |
| } else if (!strcmp(str, "reset")) { |
| reset = 1; |
| } |
