summaryrefslogtreecommitdiff
path: root/drivers/platform
diff options
context:
space:
mode:
authorHans de Goede <hdegoede@redhat.com>2021-06-09 17:17:52 +0200
committerHans de Goede <hdegoede@redhat.com>2021-06-16 17:47:55 +0200
commit0ddcf3a6b44209e73fb21b3c53e258884ea90cef (patch)
treeabf4b892d73f564cb732d0ca6f5cdae66c05f124 /drivers/platform
parent86bb2e3daf5d84c02ef40da8bf26f7b851aaa8a7 (diff)
platform/x86: think-lmi: Avoid potential read before start of the buffer
If length equals 0 then reading buf[length-1] will read before the start of the buffer. Avoid this by moving the length == 0 check up. Cc: Mark Pearson <markpearson@lenovo.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20210609151752.156902-2-hdegoede@redhat.com
Diffstat (limited to 'drivers/platform')
-rw-r--r--drivers/platform/x86/think-lmi.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 4881de4e669d..7771c9359449 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -443,10 +443,13 @@ static ssize_t kbdlang_store(struct kobject *kobj,
int length;
length = strlen(buf);
+ if (!length)
+ return -EINVAL;
+
if (buf[length-1] == '\n')
length--;
- if (!length || (length >= TLMI_LANG_MAXLEN))
+ if (length >= TLMI_LANG_MAXLEN)
return -EINVAL;
memcpy(setting->kbdlang, buf, length);