mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-07-26 22:07:51 +00:00
Koen Kooi
9bc77dff5f
Regenerate all beaglebone patches and add one vfs tracer patch for powertop Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
53 lines
1.9 KiB
Diff
53 lines
1.9 KiB
Diff
From e7d858dec1d8cf3c283019ff51adae14b8be9388 Mon Sep 17 00:00:00 2001
|
|
From: Dan Rosenberg <dan.j.rosenberg@gmail.com>
|
|
Date: Mon, 25 Jun 2012 16:05:27 +0200
|
|
Subject: [PATCH 05/49] NFC: Prevent multiple buffer overflows in NCI
|
|
|
|
commit 67de956ff5dc1d4f321e16cfbd63f5be3b691b43 upstream.
|
|
|
|
Fix multiple remotely-exploitable stack-based buffer overflows due to
|
|
the NCI code pulling length fields directly from incoming frames and
|
|
copying too much data into statically-sized arrays.
|
|
|
|
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
|
|
Cc: security@kernel.org
|
|
Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
|
|
Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
|
|
Cc: Samuel Ortiz <sameo@linux.intel.com>
|
|
Cc: David S. Miller <davem@davemloft.net>
|
|
Acked-by: Ilan Elias <ilane@ti.com>
|
|
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
|
|
[bwh: Backported to 3.2:
|
|
- Drop changes to parsing of tech B and tech F parameters
|
|
- Various renaming]
|
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
---
|
|
net/nfc/nci/ntf.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
|
|
index 96633f5..12b6a80 100644
|
|
--- a/net/nfc/nci/ntf.c
|
|
+++ b/net/nfc/nci/ntf.c
|
|
@@ -86,7 +86,7 @@ static int nci_rf_activate_nfca_passive_poll(struct nci_dev *ndev,
|
|
nfca_poll->sens_res = __le16_to_cpu(*((__u16 *)data));
|
|
data += 2;
|
|
|
|
- nfca_poll->nfcid1_len = *data++;
|
|
+ nfca_poll->nfcid1_len = min_t(__u8, *data++, sizeof(nfca_poll->nfcid1));
|
|
|
|
nfc_dbg("sens_res 0x%x, nfcid1_len %d",
|
|
nfca_poll->sens_res,
|
|
@@ -111,7 +111,7 @@ static int nci_rf_activate_nfca_passive_poll(struct nci_dev *ndev,
|
|
|
|
switch (ntf->rf_interface_type) {
|
|
case NCI_RF_INTERFACE_ISO_DEP:
|
|
- nfca_poll_iso_dep->rats_res_len = *data++;
|
|
+ nfca_poll_iso_dep->rats_res_len = min_t(__u8, *data++, 20);
|
|
if (nfca_poll_iso_dep->rats_res_len > 0) {
|
|
memcpy(nfca_poll_iso_dep->rats_res,
|
|
data,
|
|
--
|
|
1.7.10
|
|
|