Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Suchanek <msuchanek@suse.de>2018-03-14 18:22:54 +0100
committerMichal Suchanek <msuchanek@suse.de>2018-03-14 18:23:00 +0100
commitf325ec852eaf4151cdc5665b65b52e136eb8fa23 (patch)
treed6db2afcf14811bb78b50b881409da0efc6cbdf2
parent7faa42c2fcb53ca02b2686b00922428b609e5cf1 (diff)
tpm_tis: fix potential buffer overruns caused by bit glitchesrpm-4.4.120-94.17
on the bus (bsc#1020645, git-fixes). suse-commit: cf3a7bbba3a9a660b66f0c98526c4cb3a6b09961
-rw-r--r--drivers/char/tpm/tpm_tis_core.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index e79d4d9b6701..f047258a8f95 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -212,7 +212,8 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
{
struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
int size = 0;
- int expected, status;
+ int status;
+ u32 expected;
if (count < TPM_HEADER_SIZE) {
size = -EIO;
@@ -227,7 +228,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
}
expected = be32_to_cpu(*(__be32 *) (buf + 2));
- if (expected > count) {
+ if (expected > count || expected < TPM_HEADER_SIZE) {
size = -EIO;
goto out;
}