Messages in this thread | | | Date | Mon, 15 Nov 2010 11:14:57 +0300 | From | Dan Carpenter <> | Subject | Re: [patch 2/2] fbcmap: integer overflow bug |
| |
On Mon, Nov 15, 2010 at 09:01:14AM +0100, walter harms wrote: > I do not see the rest of the code but it looks like > cmap->len is size in int8_t. So the upper limit is something like > INT_MAX/(sizeof(u16)*2). Perhaps we can call it a char ? > is there ANY system that has a more than 256 colors in R|G|B ? >
Yeah. There are. I had a list of some but I've deleted it.
> <spying for struct fb_cmap_user > > __u32 len; > __u16 __user *red; > > So no need to check for <0.
I test size which is an int so that's why it's needed.
regards, dan carpenter
| |