git.samba.org
/
sfrench
/
cifs-2.6.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
[sfrench/cifs-2.6.git]
/
drivers
/
char
/
tpm
/
tpm_tis_core.c
diff --git
a/drivers/char/tpm/tpm_tis_core.c
b/drivers/char/tpm/tpm_tis_core.c
index 183a5f54d875d072b98e7aead6563f3dd3d95a62..da074e3db19be5c895f80a403aabb992e9a14d29 100644
(file)
--- a/
drivers/char/tpm/tpm_tis_core.c
+++ b/
drivers/char/tpm/tpm_tis_core.c
@@
-270,7
+270,8
@@
static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
{
struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
int size = 0;
{
struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
int size = 0;
- int expected, status;
+ int status;
+ u32 expected;
if (count < TPM_HEADER_SIZE) {
size = -EIO;
if (count < TPM_HEADER_SIZE) {
size = -EIO;
@@
-285,7
+286,7
@@
static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
}
expected = be32_to_cpu(*(__be32 *) (buf + 2));
}
expected = be32_to_cpu(*(__be32 *) (buf + 2));
- if (expected > count) {
+ if (expected > count
|| expected < TPM_HEADER_SIZE
) {
size = -EIO;
goto out;
}
size = -EIO;
goto out;
}