projects / openwrt / staging / blogic.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d8bad91) | patch
fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 8 Oct 2018 10:57:36 +0000 (12:57 +0200)
committerBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Mon, 8 Oct 2018 10:57:36 +0000 (12:57 +0200)
commite5017716adb8aa5c01c52386c1b7470101ffe9c5
tree9fe13b9419608329515b18beee4a922fab4d68fatree | snapshot
parentd8bad911e5e55e228d59c0606ff7e6b8131ca7bfcommit | diff
fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()

The "index + count" addition can overflow.  Both come directly from the
user.  This bug leads to an information leak.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Peter Malone <peter.malone@gmail.com>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
drivers/video/fbdev/sbuslib.c diff | blob | history
John Crispins staging tree