lkml.org 
[lkml]   [2010]   [Nov]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] video: arcfb: fix buffer overflow
Date
(count + p) is not checked for integer overflow.  If p < fbmemlength
and count == (size_t)(1 - p) (very big unsigned integer) then
count + p == 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)
overflows base_addr.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
---
Compile tested only.

drivers/video/arcfb.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 3ec4923..67a4cd4 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -454,7 +454,7 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
xres = info->var.xres;
fbmemlength = (xres * info->var.yres)/8;

- if (p > fbmemlength)
+ if (p > fbmemlength || (p + count < p))
return -ENOSPC;

err = 0;
--
1.7.0.4


\
 
 \ /
  Last update: 2010-11-21 18:43    [W:0.061 / U:2.876 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site