From ebfd7532e985818a327906e011f3e43c8ddfdd74 Mon Sep 17 00:00:00 2001 From: Jarkko Sakkinen Date: Mon, 12 Sep 2016 13:43:30 +0300 Subject: [PATCH] tpm: add check for minimum buffer size in tpm_transmit() tpm_transmit() does not check that bufsiz is at least TPM_HEADER_SIZE before accessing data. This commit adds this check and returns -EINVAL if it fails. Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-interface.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 3970f843acd1..8de61876f633 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -337,6 +337,9 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, u32 count, ordinal; unsigned long stop; + if (bufsiz < TPM_HEADER_SIZE) + return -EINVAL; + if (bufsiz > TPM_BUFSIZE) bufsiz = TPM_BUFSIZE; -- 2.39.5