lkml.org 
[lkml]   [2015]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 003/155] [media] media/vivid-osd: fix info leak in ioctl
    Date
    3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: =?UTF-8?q?Salva=20Peir=C3=B3?= <speirofr@gmail.com>

    commit eda98796aff0d9bf41094b06811f5def3b4c333c upstream.

    The vivid_fb_ioctl() code fails to initialize the 16 _reserved bytes of
    struct fb_vblank after the ->hcount member. Add an explicit
    memset(0) before filling the structure to avoid the info leak.

    Signed-off-by: Salva Peiró <speirofr@gmail.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Reference: CVE-2015-7884
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/media/platform/vivid/vivid-osd.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
    index 084d346..e15eef6 100644
    --- a/drivers/media/platform/vivid/vivid-osd.c
    +++ b/drivers/media/platform/vivid/vivid-osd.c
    @@ -85,6 +85,7 @@ static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg)
    case FBIOGET_VBLANK: {
    struct fb_vblank vblank;

    + memset(&vblank, 0, sizeof(vblank));
    vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT |
    FB_VBLANK_HAVE_VSYNC;
    vblank.count = 0;
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-11-13 01:41    [W:2.547 / U:0.768 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site