]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 4f399a7) | patch
drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()
authorWenliang Fan <fanwlexca@gmail.com>
Tue, 17 Dec 2013 03:25:28 +0000 (11:25 +0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 19 Dec 2013 20:02:14 +0000 (15:02 -0500)
commitcaae5046c121e4390699e78c54eda1d52252106e
tree52bc7616461aff96f0a889317b2861ec8d301eabtree | snapshot
parent4f399a7a343602bfe8b6648477c002fd34802bfccommit | diff
drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()

The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/hamradio/hdlcdrv.c diff | blob | history
Linux Kernel Source Tree.