]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 087c6e6) | patch
video: uvesafb: Fix integer overflow in allocation
authorKees Cook <keescook@chromium.org>
Fri, 11 May 2018 08:24:12 +0000 (18:24 +1000)
committerKees Cook <keescook@chromium.org>
Tue, 12 Jun 2018 23:19:22 +0000 (16:19 -0700)
commite26698a2e863032a60d60b93a52257302d1999ee
tree6a89ba3f5af7cb4c8415a8dd2589146b3018bed7tree | snapshot
parent087c6e63c53584db1bff499d579c696d1d0d5850commit | diff
video: uvesafb: Fix integer overflow in allocation

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: b44bdaa5f1190 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
drivers/video/fbdev/uvesafb.c diff | blob | history
Linux Kernel Source Tree.