diff options
| author | Hans de Goede | 2021-06-09 17:17:52 +0200 |
|---|---|---|
| committer | Hans de Goede | 2021-06-16 17:47:55 +0200 |
| commit | 0ddcf3a6b44209e73fb21b3c53e258884ea90cef (patch) | |
| tree | abf4b892d73f564cb732d0ca6f5cdae66c05f124 /drivers/platform/x86/think-lmi.c | |
| parent | 86bb2e3daf5d84c02ef40da8bf26f7b851aaa8a7 (diff) | |
platform/x86: think-lmi: Avoid potential read before start of the buffer
If length equals 0 then reading buf[length-1] will read before the start
of the buffer.
Avoid this by moving the length == 0 check up.
Cc: Mark Pearson <markpearson@lenovo.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210609151752.156902-2-hdegoede@redhat.com
Diffstat (limited to 'drivers/platform/x86/think-lmi.c')
| -rw-r--r-- | drivers/platform/x86/think-lmi.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c index 4881de4e669d..7771c9359449 100644 --- a/drivers/platform/x86/think-lmi.c +++ b/drivers/platform/x86/think-lmi.c @@ -443,10 +443,13 @@ static ssize_t kbdlang_store(struct kobject *kobj, int length; length = strlen(buf); + if (!length) + return -EINVAL; + if (buf[length-1] == '\n') length--; - if (!length || (length >= TLMI_LANG_MAXLEN)) + if (length >= TLMI_LANG_MAXLEN) return -EINVAL; memcpy(setting->kbdlang, buf, length); |