iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vc_screen: sanitize types in vcs_write

Browse Source 
* ret can carry error codes, so make it signed, i.e. ssize_t
* pos is derived from the passed ppos, so make it long enough, i.e.
  loff_t
* attr is a boolean, so...
* size is limited by vcs_size() which returns an int
* written, p, orig_count and this_round are always ">= 0" and "< size",
  so uint is enough
* col and max_col are derived from vc->vc_cols (uint) and p, so make
  them uint too
* place con_buf0 and con_buf declaration to a single line

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200818085706.12163-6-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jiri Slaby 2020-08-18 10:56:56 +02:00 committed by Greg Kroah-Hartman
parent 71d4abfab3
commit 2665bef49f
1 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/tty/vt/vc_screen.c
View File

@ -459,14 +459,13 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
{ {
struct inode *inode = file_inode(file); struct inode *inode = file_inode(file);
struct vc_data *vc; struct vc_data *vc;
long pos; char *con_buf0, *con_buf;
long attr, size, written;
char *con_buf0;
int col, maxcol;
u16 *org0 = NULL, *org = NULL; u16 *org0 = NULL, *org = NULL;
size_t ret; unsigned int written, col, maxcol;
char *con_buf; int size;
bool viewed; ssize_t ret;
loff_t pos;
bool viewed, attr;
if (use_unicode(inode)) if (use_unicode(inode))
return -EOPNOTSUPP; return -EOPNOTSUPP;
@ -500,9 +499,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
count = size - pos; count = size - pos;
written = 0; written = 0;
while (count) { while (count) {
long this_round = count; unsigned int orig_count, p, this_round = count;
size_t orig_count;
long p;
if (this_round > CON_BUF_SIZE) if (this_round > CON_BUF_SIZE)
this_round = CON_BUF_SIZE; this_round = CON_BUF_SIZE;