Unverified Commit 4e89a407 authored by Vladimir Moskovkin's avatar Vladimir Moskovkin Committed by Ilpo Järvinen
Browse files

platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() 



If the 'buf' array received from the user contains an empty string, the
'length' variable will be zero. Accessing the 'buf' array element with
index 'length - 1' will result in a buffer overflow.

Add a check for an empty string.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e8a60aa7 ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarVladimir Moskovkin <Vladimir.Moskovkin@kaspersky.com>
Link: https://lore.kernel.org/r/39973642a4f24295b4a8fad9109c5b08@kaspersky.com


Reviewed-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
parent a7e255ff

drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c

+1 −1
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ static ssize_t current_password_store(struct kobject *kobj, 
	int length;



	length = strlen(buf);

	if (buf[length-1] == '\n')

	if (length && buf[length - 1] == '\n')

		length--;



	/* firmware does verifiation of min/max password length,