]> git.baikalelectronics.ru Git - kernel.git/commit
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
authorHyunwoo Kim <imv4bel@gmail.com>
Mon, 20 Jun 2022 14:17:46 +0000 (07:17 -0700)
committerHelge Deller <deller@gmx.de>
Mon, 20 Jun 2022 18:12:17 +0000 (20:12 +0200)
commit1d3a3c4fe8dfe6336b2018f1aebbb5360a9cb898
treebb8b03e867f3730cc49a0bce5663ad5ddafeb09c
parent88922a6fa63783ef9653f6c320d5f66a2fa58d18
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write

In pxa3xx_gcu_write, a count parameter of type size_t is passed to words of
type int.  Then, copy_from_user() may cause a heap overflow because it is used
as the third argument of copy_from_user().

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
drivers/video/fbdev/pxa3xx-gcu.c