Dan Carpenter bf3a1a8c91 tpm: Check for integer overflow in tpm2_map_response_body() ...

commit a0bcce2b2a upstream.

The "4 * be32_to_cpu(data->count)" multiplication can potentially
overflow which would lead to memory corruption.  Add a check for that.

Cc: stable@vger.kernel.org
Fixes: 745b361e98 ("tpm: infrastructure for TPM spaces")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-11-26 11:35:57 +01:00

..

agp

…

hw_random

…

ipmi

…

mwave

…

pcmcia

…

tpm

tpm: Check for integer overflow in tpm2_map_response_body()

2021-11-26 11:35:57 +01:00

xilinx_hwicap

…

xillybus

…

adi.c

…

apm-emulation.c

…

applicom.c

…

applicom.h

…

bsr.c

…

ds1620.c

…

dsp56k.c

…

dtlk.c

…

efirtc.c

…

generic_nvram.c

…

hangcheck-timer.c

…

hpet.c

…

Kconfig

…

lp.c

…

Makefile

…

mbcs.c

…

mbcs.h

…

mem.c

…

misc.c

…

mspec.c

…

nsc_gpio.c

…

nvram.c

…

nwbutton.c

…

nwbutton.h

…

nwflash.c

…

pc8736x_gpio.c

…

powernv-op-panel.c

…

ppdev.c

…

ps3flash.c

…

random.c

…

raw.c

…

rtc.c

…

scx200_gpio.c

…

snsc_event.c

…

snsc.c

…

snsc.h

…

sonypi.c

…

tb0219.c

…

tlclk.c

…

toshiba.c

…

ttyprintk.c

…

uv_mmtimer.c

…

virtio_console.c

virtio_console: Assure used length from device is limited

2021-07-20 16:16:12 +02:00