lkml.org 
[lkml]   [2011]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] [174/275] keyboard: integer underflow bug
    Date
    2.6.35-longterm review patch.  If anyone has any objections, please let me know.

    ------------------
    From: Dan Carpenter <error27@gmail.com>

    commit b652277b09d3d030cb074cc6a98ba80b34244c03 upstream.

    The "ct" variable should be an unsigned int. Both struct kbdiacrs
    ->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints.

    Making it signed causes a problem in KBDIACRUC because the user could
    set the signed bit and cause a buffer overflow.

    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>

    ---
    drivers/s390/char/keyboard.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    Index: linux-2.6.35.y/drivers/s390/char/keyboard.c
    ===================================================================
    --- linux-2.6.35.y.orig/drivers/s390/char/keyboard.c 2011-03-29 22:50:54.267869839 -0700
    +++ linux-2.6.35.y/drivers/s390/char/keyboard.c 2011-03-29 23:03:01.863252494 -0700
    @@ -460,7 +460,8 @@
    unsigned int cmd, unsigned long arg)
    {
    void __user *argp;
    - int ct, perm;
    + unsigned int ct;
    + int perm;

    argp = (void __user *)arg;


    \
     
     \ /
      Last update: 2011-03-30 23:37    [W:0.019 / U:63.988 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site