UBUNTU: [Config] arm64: snapdragon: SND*=m

[mirror_ubuntu-bionic-kernel.git] / fs / binfmt_misc.c

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index a7c5a9861bef5a73b8f7377dfa9e045427b915c7..8311e8ed76de37542d35dffc90c039452572f50e 100644 (file)
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -387,8 +387,13 @@ static Node *create_entry(const char __user *buffer, size_t count)
                s = strchr(p, del);
                if (!s)
                        goto einval;
-               *s++ = '\0';
-               e->offset = simple_strtoul(p, &p, 10);
+               *s = '\0';
+               if (p != s) {
+                       int r = kstrtoint(p, 10, &e->offset);
+                       if (r != 0 || e->offset < 0)
+                               goto einval;
+               }
+               p = s;
                if (*p++)
                        goto einval;
                pr_debug("register: offset: %#x\n", e->offset);
@@ -428,7 +433,8 @@ static Node *create_entry(const char __user *buffer, size_t count)
                if (e->mask &&
                    string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)
                        goto einval;
-               if (e->size + e->offset > BINPRM_BUF_SIZE)
+               if (e->size > BINPRM_BUF_SIZE ||
+                   BINPRM_BUF_SIZE - e->size < e->offset)
                        goto einval;
                pr_debug("register: magic/mask length: %i\n", e->size);
                if (USE_DEBUG) {