Skip to content
  • Gwendal Grignou's avatar
    platform/chrome: cros_ec_dev - Fix security issue · 5d749d0b
    Gwendal Grignou authored
    
    
    Prevent memory scribble by checking that ioctl buffer size parameters
    are sane.
    Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and
    .outsize the amount to scribble, we would overflow, allocate a small
    amounts and be able to write outside of the malloc'ed area.
    Adding a hard limit allows argument checking of the ioctl. With the
    current EC, it is expected .insize and .outsize to be at around 512 bytes
    or less.
    
    Signed-off-by: default avatarGwendal Grignou <gwendal@chromium.org>
    Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
    5d749d0b