diff options
| author | Yu Kuai <yukuai3@huawei.com> | 2021-05-21 20:06:17 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-14 16:53:40 +0200 |
| commit | a536c30966c1821536c2d902f637813e19f4e4ae (patch) | |
| tree | f2427125e9bc4a57e6586182cc0703532ad3aa29 /drivers/char/pcmcia | |
| parent | 6490ed7c4684caf9851a0b98e0ab17a8d693dada (diff) | |
char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol()
[ Upstream commit 37188559c610f1b7eec83c8e448936c361c578de ]
Theoretically, it will cause index out of bounds error if
'num_bytes_read' is greater than 4. As we expect it(and was tested)
never to be greater than 4, error out if it happens.
Fixes: c1986ee9bea3 ("[PATCH] New Omnikey Cardman 4000 driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20210521120617.138396-1-yukuai3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/char/pcmcia')
| -rw-r--r-- | drivers/char/pcmcia/cm4000_cs.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c index 15bf585af5d3..44117169db91 100644 --- a/drivers/char/pcmcia/cm4000_cs.c +++ b/drivers/char/pcmcia/cm4000_cs.c @@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) io_read_num_rec_bytes(iobase, &num_bytes_read); if (num_bytes_read >= 4) { DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read); + if (num_bytes_read > 4) { + rc = -EIO; + goto exit_setprotocol; + } break; } usleep_range(10000, 11000); |