diff options
| author | Jiri Slaby <jslaby@suse.cz> | 2020-08-18 11:56:56 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-18 14:45:21 +0300 |
| commit | 2665bef49f96df1a541b4e71e7b27bf631f7667c (patch) | |
| tree | ae13135ba8174c1a18b6f8b3aa3038a04d4ab76c /drivers/tty/vt/vc_screen.c | |
| parent | 71d4abfab322e827a75304431fe0fad3c805cb80 (diff) | |
| download | linux-2665bef49f96df1a541b4e71e7b27bf631f7667c.tar.xz | |
vc_screen: sanitize types in vcs_write
* ret can carry error codes, so make it signed, i.e. ssize_t
* pos is derived from the passed ppos, so make it long enough, i.e.
loff_t
* attr is a boolean, so...
* size is limited by vcs_size() which returns an int
* written, p, orig_count and this_round are always ">= 0" and "< size",
so uint is enough
* col and max_col are derived from vc->vc_cols (uint) and p, so make
them uint too
* place con_buf0 and con_buf declaration to a single line
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200818085706.12163-6-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/vt/vc_screen.c')
| -rw-r--r-- | drivers/tty/vt/vc_screen.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 8aa0d50bcac7..2571d9067b08 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -459,14 +459,13 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { struct inode *inode = file_inode(file); struct vc_data *vc; - long pos; - long attr, size, written; - char *con_buf0; - int col, maxcol; + char *con_buf0, *con_buf; u16 *org0 = NULL, *org = NULL; - size_t ret; - char *con_buf; - bool viewed; + unsigned int written, col, maxcol; + int size; + ssize_t ret; + loff_t pos; + bool viewed, attr; if (use_unicode(inode)) return -EOPNOTSUPP; @@ -500,9 +499,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) count = size - pos; written = 0; while (count) { - long this_round = count; - size_t orig_count; - long p; + unsigned int orig_count, p, this_round = count; if (this_round > CON_BUF_SIZE) this_round = CON_BUF_SIZE; |