Chen Gang a5f2b3d6a7 drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow ...

When calling memcpy, read_data and write_data need additional 2 bytes.

  write_data:
    for checking:  "if (size > IPMI_MAX_MSG_LENGTH)"
    for operating: "memcpy(bt->write_data + 3, data + 1, size - 1)"

  read_data:
    for checking:  "if (msg_len < 3 || msg_len > IPMI_MAX_MSG_LENGTH)"
    for operating: "memcpy(data + 2, bt->read_data + 4, msg_len - 2)"

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2013-05-16 13:49:25 -07:00

..

ipmi_bt_sm.c

drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow

2013-05-16 13:49:25 -07:00

ipmi_devintf.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ipmi_kcs_sm.c

ipmi: increase KCS timeouts

2012-03-28 17:14:36 -07:00

ipmi_msghandler.c

drivers: char: ipmi: Replaced kmalloc and strcpy with kstrdup

2013-05-16 13:49:25 -07:00

ipmi_poweroff.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

ipmi_si_intf.c

procfs: new helper - PDE_DATA(inode)

2013-04-09 14:13:32 -04:00

ipmi_si_sm.h

…

ipmi_smic_sm.c

…

ipmi_watchdog.c

char/ipmi: remove local ioctl defines replaced by generic ones

2012-07-23 12:48:04 +02:00

Kconfig

…

Makefile

drivers/char/ipmi/Makefile: replace the use of <module>-objs with <module>-y

2010-10-27 18:03:14 -07:00