Home page logo
/

oss-sec logo oss-sec mailing list archives

CVE request - kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl()
From: Eugene Teo <eugene () redhat com>
Date: Wed, 11 Jan 2012 18:50:12 +0800

There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if
userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result in
a memory corruption.

Reported-by: Haogang Chen <haogangchen () gmail com>
Signed-off-by: Xi Wang <xi.wang () gmail com>

Upstream commit:
http://git.kernel.org/linus/a5cd335165e31db9dbab636fd29895d41da55dd2


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]