Messages in this thread | | | Date | Mon, 15 Nov 2010 10:20:15 +0300 | From | Dan Carpenter <> | Subject | Re: [patch 2/2] fbcmap: integer overflow bug |
| |
On Mon, Nov 15, 2010 at 07:56:05AM +0100, Geert Uytterhoeven wrote: > On Mon, Nov 15, 2010 at 05:48, Paul Mundt <lethal@linux-sh.org> wrote: > > On Sat, Nov 13, 2010 at 01:07:18PM +0300, Dan Carpenter wrote: > >> @@ -256,8 +264,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info) > >> int rc, size = cmap->len * sizeof(u16); > >> struct fb_cmap umap; > >> > >> + if (cmap->len * 2 > INT_MAX) > > Isn't that another integer overflow? I.e. should be "if (cmap->len > > INT_MAX / sizeof(u16))" instead? >
Yeah it is. :/
I'll change it to: if (size < 0 || size < cmap->len) like Paul asked.
regards, dan carpenter
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |