Re: Misc 2.5 Fixes: cp-user-zoran

From: Dipankar Sarma (dipankar@in.ibm.com)
Date: Tue Jun 10 2003 - 05:22:55 EST


Use copy_to_user/put_user with user buffers.

 drivers/media/video/zoran_procfs.c | 6 +++++-
 drivers/media/video/zr36120.c | 12 ++++++------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff -puN drivers/media/video/zoran_procfs.c~cp-user-zoran drivers/media/video/zoran_procfs.c
--- linux-2.5.70-ds/drivers/media/video/zoran_procfs.c~cp-user-zoran 2003-06-08 04:10:38.000000000 +0530
+++ linux-2.5.70-ds-dipankar/drivers/media/video/zoran_procfs.c 2003-06-08 04:10:38.000000000 +0530
@@ -119,7 +119,11 @@ static int zoran_write_proc(struct file
                 printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name);
                 return -ENOMEM;
         }
- memcpy(string, buffer, count);
+ if(copy_from_user(string, buffer, count))
+ {
+ vfree(string);
+ return -EFAULT;
+ }
         string[count] = 0;
         DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data));
         ldelim = " \t\n";
diff -puN drivers/media/video/zr36120.c~cp-user-zoran drivers/media/video/zr36120.c
--- linux-2.5.70-ds/drivers/media/video/zr36120.c~cp-user-zoran 2003-06-08 04:10:38.000000000 +0530
+++ linux-2.5.70-ds-dipankar/drivers/media/video/zr36120.c 2003-06-08 04:10:38.000000000 +0530
@@ -1693,12 +1693,12 @@ long vbi_read(struct video_device* dev,
                         for (x=0; optr+1<eptr && x<-done->w; x++)
                         {
                                 unsigned char a = iptr[x*2];
- *optr++ = a;
- *optr++ = a;
+ __put_user(a, optr++);
+ __put_user(a, optr++);
                         }
                         /* and clear the rest of the line */
                         for (x*=2; optr<eptr && x<done->bpl; x++)
- *optr++ = 0;
+ __put_user(0, optr++);
                         /* next line */
                         iptr += done->bpl;
                 }
@@ -1715,10 +1715,10 @@ long vbi_read(struct video_device* dev,
                 {
                         /* copy to doubled data to userland */
                         for (x=0; optr<eptr && x<-done->w; x++)
- *optr++ = iptr[x*2];
+ __put_user(iptr[x*2], optr++);
                         /* and clear the rest of the line */
                         for (;optr<eptr && x<done->bpl; x++)
- *optr++ = 0;
+ __put_user(0, optr++);
                         /* next line */
                         iptr += done->bpl;
                 }
@@ -1727,7 +1727,7 @@ long vbi_read(struct video_device* dev,
         /* API compliance:
          * place the framenumber (half fieldnr) in the last long
          */
- ((ulong*)eptr)[-1] = done->fieldnr/2;
+ __put_user(done->fieldnr/2, ((ulong*)eptr)-1);
         }
 
         /* keep the engine running */

_
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sun Jun 15 2003 - 22:00:23 EST