Replace simple memcpy() from user buffer by copy_from_user() construction.

1 files changed, 18 insertions, 3 deletions

diff --git a/linux/drivers/media/dvb/ttpci/av7110_ir.c b/linux/drivers/media/dvb/ttpci/av7110_ir.c
index de1efcd24..3c4a30b8d 100644
--- a/linux/drivers/media/dvb/ttpci/av7110_ir.c
+++ b/linux/drivers/media/dvb/ttpci/av7110_ir.c
@@ -148,11 +148,26 @@ static
 int av7110_ir_write_proc (struct file *file, const char *buffer,
 	                  unsigned long count, void *data)
 {
-	if (count < 4 + 256 * sizeof(u16))
+	char *page;
+	int size = 4 + 256 * sizeof(u16);
+	
+	if (count < size)
 		return -EINVAL;
+
+	page = (char *)vmalloc(size);
+	if( NULL == page ) {
+		return -ENOMEM;
+	}
 	
-	memcpy (&ir_config, buffer, 4);
-	memcpy (&key_map, buffer + 4, 256 * sizeof(u16));
+	if (copy_from_user(page, buffer, size)) {
+		vfree(page);
+		return -EFAULT;
+	}
+
+	memcpy (&ir_config, page, 4);
+	memcpy (&key_map, page + 4, 256 * sizeof(u16));
+
+	vfree(page);
 
 	av7110_setup_irc_config (NULL, ir_config);