iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

platform/x86: asus-wmi: Potential buffer overflow in asus_wmi_evaluate_method_buf()

Browse Source 
This code tests for if the obj->buffer.length is larger than the buffer
but then it just does the memcpy() anyway.

Fixes: 0f0ac158d28f ("platform/x86: asus-wmi: Add support for custom fan curves")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220413073744.GB8812@kili
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
This commit is contained in:
Dan Carpenter 2022-04-13 10:37:44 +03:00 committed by Hans de Goede
parent acd51562e0
commit d2833762f2
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/platform/x86/asus-wmi.c
View File

@ -371,10 +371,14 @@ static int asus_wmi_evaluate_method_buf(u32 method_id,
switch (obj->type) {
case ACPI_TYPE_BUFFER:
if (obj->buffer.length > size)
if (obj->buffer.length > size) {
err = -ENOSPC;
if (obj->buffer.length == 0)
break;
}
if (obj->buffer.length == 0) {
err = -ENODATA;
break;
}
memcpy(ret_buffer, obj->buffer.pointer, obj->buffer.length);
break;