Messages in this thread | | | Date | Wed, 10 Mar 2021 16:46:22 +0900 | From | Sergey Senozhatsky <> | Subject | Re: [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap |
| |
On (21/03/10 08:40), Ricardo Ribalda wrote: > > The plane_length is an unsigned integer. So, if we have a size of > 0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32. > > Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org> > Cc: stable@vger.kernel.org > Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap") > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
FWIF, Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
| |