]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 47c1144) | patch
drm/savage: fix integer overflows in savage_bci_cmdbuf()
authorXi Wang <xi.wang@gmail.com>
Fri, 6 Apr 2012 21:38:24 +0000 (17:38 -0400)
committerDave Airlie <airlied@redhat.com>
Tue, 10 Apr 2012 09:22:51 +0000 (10:22 +0100)
commit033c74876e1abd19d234c2c4b233e960a57a822f
tree47795de3efba773e42336c954b8f15675c156536tree | snapshot
parent47c1144799308b0103bb7da1e0b3790bebc7c6ffcommit | diff
drm/savage: fix integer overflows in savage_bci_cmdbuf()

Since cmdbuf->size and cmdbuf->nbox are from userspace, a large value
would overflow the allocation size, leading to out-of-bounds access.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/savage/savage_state.c diff | blob | history
Linux Kernel Source Tree.