diff options
| author | Steve Holland <sdh4@iastate.edu> | 2009-06-18 17:37:49 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-23 06:46:35 -0700 |
| commit | 92d07e422df3cc5370d0d9b95a671abb69d50ef1 (patch) | |
| tree | 497f5e7e185c98405d4966d895e37b9edcbba52d /drivers | |
| parent | c2cd26e15b84b964c489f2aff278cdaf03840c93 (diff) | |
| download | linux-92d07e422df3cc5370d0d9b95a671abb69d50ef1.tar.bz2 | |
USB: usbtmc: inhibit corruption
Limit data copied to userspace to amount requested. Prevents a faulty
instrument from overwriting user memory.
Signed-off-by: Steve Holland <sdh4@iastate.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/class/usbtmc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index f2fde7cd6109..91d3a94eeaa0 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -473,6 +473,10 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf, n_characters = this_part; } + /* Bound amount of data received by amount of data requested */ + if (n_characters > this_part) + n_characters = this_part; + /* Copy buffer to user space */ if (copy_to_user(buf + done, &buffer[12], n_characters)) { /* There must have been an addressing problem */ |