diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-04-13 10:37:44 +0300 |
|---|---|---|
| committer | Hans de Goede <hdegoede@redhat.com> | 2022-04-27 16:55:54 +0200 |
| commit | 4345ece8f0bcc682f1fb3b648922c9be5f7dbe6c (patch) | |
| tree | 2aabb4162a9ce8d41ebbefe4601893ed4f071114 /drivers | |
| parent | b2dd71f9f728da695a86b8308feb4f39defe9019 (diff) | |
| download | linux-4345ece8f0bcc682f1fb3b648922c9be5f7dbe6c.tar.gz | |
platform/x86: asus-wmi: Potential buffer overflow in asus_wmi_evaluate_method_buf()
This code tests for if the obj->buffer.length is larger than the buffer
but then it just does the memcpy() anyway.
Fixes: 0f0ac158d28f ("platform/x86: asus-wmi: Add support for custom fan curves")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220413073744.GB8812@kili
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/platform/x86/asus-wmi.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c index 2104a2621e50..7e3c0a8e3997 100644 --- a/drivers/platform/x86/asus-wmi.c +++ b/drivers/platform/x86/asus-wmi.c @@ -371,10 +371,14 @@ static int asus_wmi_evaluate_method_buf(u32 method_id, switch (obj->type) { case ACPI_TYPE_BUFFER: - if (obj->buffer.length > size) + if (obj->buffer.length > size) { err = -ENOSPC; - if (obj->buffer.length == 0) + break; + } + if (obj->buffer.length == 0) { err = -ENODATA; + break; + } memcpy(ret_buffer, obj->buffer.pointer, obj->buffer.length); break; |