Messages in this thread | | | Date | Mon, 15 Nov 2010 09:01:14 +0100 | From | walter harms <> | Subject | Re: [patch 2/2] fbcmap: integer overflow bug |
| |
Am 15.11.2010 08:20, schrieb Dan Carpenter: > On Mon, Nov 15, 2010 at 07:56:05AM +0100, Geert Uytterhoeven wrote: >> On Mon, Nov 15, 2010 at 05:48, Paul Mundt <lethal@linux-sh.org> wrote: >>> On Sat, Nov 13, 2010 at 01:07:18PM +0300, Dan Carpenter wrote: >>>> @@ -256,8 +264,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info) >>>> int rc, size = cmap->len * sizeof(u16); >>>> struct fb_cmap umap; >>>> >>>> + if (cmap->len * 2 > INT_MAX) >> >> Isn't that another integer overflow? I.e. should be "if (cmap->len > >> INT_MAX / sizeof(u16))" instead? >> > > Yeah it is. :/ > > I'll change it to: > if (size < 0 || size < cmap->len) > like Paul asked. >
I do not see the rest of the code but it looks like cmap->len is size in int8_t. So the upper limit is something like INT_MAX/(sizeof(u16)*2). Perhaps we can call it a char ? is there ANY system that has a more than 256 colors in R|G|B ?
<spying for struct fb_cmap_user > __u32 len; __u16 __user *red;
So no need to check for <0.
hope that helps, re, wh
| |