]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c38a02d) | patch
drm/savage: fix integer overflows in savage_bci_cmdbuf()
authorXi Wang <xi.wang@gmail.com>
Fri, 6 Apr 2012 21:38:24 +0000 (17:38 -0400)
committerDave Airlie <airlied@redhat.com>
Tue, 10 Apr 2012 09:22:51 +0000 (10:22 +0100)
commit9c82a9cc9fb9c18a27eda3ab8feea766adb317a5
tree47795de3efba773e42336c954b8f15675c156536tree | snapshot
parentc38a02df527c119fe782add27c36542a4d7ff364commit | diff
drm/savage: fix integer overflows in savage_bci_cmdbuf()

Since cmdbuf->size and cmdbuf->nbox are from userspace, a large value
would overflow the allocation size, leading to out-of-bounds access.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/savage/savage_state.c diff | blob | history
Linux Kernel Source Tree.