[PATCH 4/4] [OpenPROM] Prevent unsigned roll-overs in

property_read/property_write

These overflow fixes were originally submitted to 2.5 by Dave Miller:
  http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d69d83b4f8vl6uetYp1vi77lhBJOQ
  http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d6aabcc3jBCcQB6wlZ7s3G9WGPYsg

Signed-off-by: dann frazier <dannf@hp.com>

diff --git a/fs/openpromfs/inode.c b/fs/openpromfs/inode.c
index 5d2712f..1963e66 100644 (file)
--- a/fs/openpromfs/inode.c
+++ b/fs/openpromfs/inode.c
@@ -97,7 +97,7 @@ static ssize_t property_read(struct file *filp, char *buf,
        openprom_property *op;
        char buffer[64];
        
-       if (pos < 0 || pos >= 0xffffff)
+       if (pos < 0 || pos >= 0xffffff || count >= 0xffffff)
                return -EINVAL;
        if (!filp->private_data) {
                node = nodes[(u16)((long)inode->u.generic_ip)].node;
@@ -331,7 +331,7 @@ static ssize_t property_write(struct file *filp, const char *buf,
        void *b;
        openprom_property *op;
        
-       if (pos < 0 || pos >= 0xffffff)
+       if (pos < 0 || pos >= 0xffffff || count >= 0xffffff)
                return -EINVAL;
        if (!filp->private_data) {
                i = property_read (filp, NULL, 0, 0);