git.samba.org
/
sfrench
/
cifs-2.6.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
[sfrench/cifs-2.6.git]
/
drivers
/
char
/
tpm
/
st33zp24
/
st33zp24.c
diff --git
a/drivers/char/tpm/st33zp24/st33zp24.c
b/drivers/char/tpm/st33zp24/st33zp24.c
index 4d1dc8b46877ca497a198a3d988d060b9235100a..f95b9c75175bcf27825b16891ca405886e51c379 100644
(file)
--- a/
drivers/char/tpm/st33zp24/st33zp24.c
+++ b/
drivers/char/tpm/st33zp24/st33zp24.c
@@
-457,7
+457,7
@@
static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf,
size_t count)
{
int size = 0;
-
int
expected;
+
u32
expected;
if (!chip)
return -EBUSY;
@@
-474,7
+474,7
@@
static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf,
}
expected = be32_to_cpu(*(__be32 *)(buf + 2));
- if (expected > count) {
+ if (expected > count
|| expected < TPM_HEADER_SIZE
) {
size = -EIO;
goto out;
}