[PATCH] video: arcfb: fix buffer overflow

From: Vasiliy Kulikov
Date: Sun Nov 21 2010 - 12:40:28 EST


(count + p) is not checked for integer overflow. If p < fbmemlength
and count == (size_t)(1 - p) (very big unsigned integer) then
count + p == 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)
overflows base_addr.

Signed-off-by: Vasiliy Kulikov <segoon@xxxxxxxxxxxx>
---
Compile tested only.

drivers/video/arcfb.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 3ec4923..67a4cd4 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -454,7 +454,7 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
xres = info->var.xres;
fbmemlength = (xres * info->var.yres)/8;

- if (p > fbmemlength)
+ if (p > fbmemlength || (p + count < p))
return -ENOSPC;

err = 0;
--
1.7.0.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/