lkml.org 
[lkml]   [2013]   [Sep]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
Subject[BUG] Buffer Overflow in drivers/video/fbmem.c
From
Hi,
Buffer overflow found in drivers/video/fbmem.c.
[Version]:Newest

[Detail]:
1592 static int do_register_framebuffer(struct fb_info *fb_info)
1593 {
1594 | int i;
1595 | struct fb_event event;
1596 | struct fb_videomode mode;
........
1607 | num_registered_fb++;
1608 | for (i = 0 ; i < FB_MAX; i++) //******* i could be FB_MAX
after loop *********/
1609 | | if (!registered_fb[i])
1610 | | | break;
........

1646 | fb_var_to_videomode(&mode, &fb_info->var);
1647 | fb_add_videomode(&mode, &fb_info->modelist);
1648 | registered_fb[i] = fb_info; // ****** Here will be a
off-by-one overflow *******/


\
 
 \ /
  Last update: 2013-09-23 14:01    [W:0.034 / U:2.716 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site