seq_tab_next() should increase position index

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / fs / binfmt_misc.c

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 78f005f..dd784bc 100644 (file)
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -369,8 +369,13 @@ static Node *create_entry(const char __user *buffer, size_t count)
                s = strchr(p, del);
                if (!s)
                        goto einval;
-               *s++ = '\0';
-               e->offset = simple_strtoul(p, &p, 10);
+               *s = '\0';
+               if (p != s) {
+                       int r = kstrtoint(p, 10, &e->offset);
+                       if (r != 0 || e->offset < 0)
+                               goto einval;
+               }
+               p = s;
                if (*p++)
                        goto einval;
                pr_debug("register: offset: %#x\n", e->offset);
@@ -410,7 +415,8 @@ static Node *create_entry(const char __user *buffer, size_t count)
                if (e->mask &&
                    string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)
                        goto einval;
-               if (e->size + e->offset > BINPRM_BUF_SIZE)
+               if (e->size > BINPRM_BUF_SIZE ||
+                   BINPRM_BUF_SIZE - e->size < e->offset)
                        goto einval;
                pr_debug("register: magic/mask length: %i\n", e->size);
                if (USE_DEBUG) {