提交 690e7448 编写于 作者: D Dave Jones 提交者: James Bottomley

[SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080

A negative offset could be used to index before the event buffer and
lead to a security breach.
Signed-off-by: NDave Jones <davej@redhat.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>
上级 198439e4
......@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *ha, int handle, gdth_evt_str *estr)
eindex = handle;
estr->event_source = 0;
if (eindex >= MAX_EVENTS) {
if (eindex < 0 || eindex >= MAX_EVENTS) {
spin_unlock_irqrestore(&ha->smp_lock, flags);
return eindex;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册