forked from luck/tmp_suning_uos_patched
1eafbfeb7b
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating OSF partitions contains a bug that leaks data
from kernel heap memory to userspace for certain corrupted OSF
partitions.
In more detail:
for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
iterates from 0 to d_npartitions - 1, where d_npartitions is read from
the partition table without validation and partition is a pointer to an
array of at most 8 d_partitions.
Add the proper and obvious validation.
Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: stable@kernel.org
[ Changed the patch trivially to not repeat the whole le16_to_cpu()
thing, and to use an explicit constant for the magic value '8' ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|---|---|---|
| .. | ||
| acorn.c | ||
| acorn.h | ||
| amiga.c | ||
| amiga.h | ||
| atari.c | ||
| atari.h | ||
| check.c | ||
| check.h | ||
| efi.c | ||
| efi.h | ||
| ibm.c | ||
| ibm.h | ||
| karma.c | ||
| karma.h | ||
| Kconfig | ||
| ldm.c | ||
| ldm.h | ||
| mac.c | ||
| mac.h | ||
| Makefile | ||
| msdos.c | ||
| msdos.h | ||
| osf.c | ||
| osf.h | ||
| sgi.c | ||
| sgi.h | ||
| sun.c | ||
| sun.h | ||
| sysv68.c | ||
| sysv68.h | ||
| ultrix.c | ||
| ultrix.h | ||