diff options
| author | Roel Kluin <roel.kluin@gmail.com> | 2009-12-11 08:43:15 -0600 |
|---|---|---|
| committer | Jason Wessel <jason.wessel@windriver.com> | 2009-12-11 08:43:15 -0600 |
| commit | b4f1b67be99d6eda8f2f252460905858ace871ef (patch) | |
| tree | 192b55a4f009716d7a4e82ac061c9b8e89ffb377 /drivers/misc | |
| parent | 84667d4849b0e0a939a76f9f62d45fa3b4d59692 (diff) | |
kgdbts: Read buffer overflow
Prevent write to put_buf[BUFMAX] in kgdb test suite.
If put_buf_cnt was BUFMAX - 1 at the earlier test,
`\0' is written to put_buf[BUFMAX].
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/kgdbts.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c index e4ff50b95a5..2ab04923d70 100644 --- a/drivers/misc/kgdbts.c +++ b/drivers/misc/kgdbts.c @@ -712,6 +712,12 @@ static int run_simple_test(int is_get_char, int chr) /* End of packet == #XX so look for the '#' */ if (put_buf_cnt > 3 && put_buf[put_buf_cnt - 3] == '#') { + if (put_buf_cnt >= BUFMAX) { + eprintk("kgdbts: ERROR: put buffer overflow on" + " '%s' line %i\n", ts.name, ts.idx); + put_buf_cnt = 0; + return 0; + } put_buf[put_buf_cnt] = '\0'; v2printk("put%i: %s\n", ts.idx, put_buf); /* Trigger check here */ |