The fbmem.c bug made "less /proc/fb" segfault, as it made read()
returned more
bytes than were requested.
The offb.c bug caused /proc/fb output to be incorrect, and potentially
could cause kernel data structure corruption.
Enjoy,
Segher
--->SNIP HERE<---
diff -ur linux-2.2.19/drivers/video/fbmem.c linux-2.2.19-patched/drivers/video/fbmem.c
--- linux-2.2.19/drivers/video/fbmem.c Sat May 5 15:41:06 2001
+++ linux-2.2.19-patched/drivers/video/fbmem.c Sat May 5 15:41:06 2001
@@ -251,14 +251,16 @@
{
struct fb_info **fi;
- len = 0;
+ int buflen = 0;
for (fi = registered_fb; fi < ®istered_fb[FB_MAX] && len < 4000; fi++)
if (*fi)
- len += sprintf(buf + len, "%d %s\n",
+ buflen += sprintf(buf + buflen, "%d %s\n",
GET_FB_IDX((*fi)->node),
(*fi)->modename);
*start = buf + offset;
- return len > offset ? len - offset : 0;
+
+ buflen = buflen > offset ? buflen - offset : 0;
+ return len < buflen ? len : buflen;
}
static ssize_t
diff -ur linux-2.2.19/drivers/video/offb.c linux-2.2.19-patched/drivers/video/offb.c
--- linux-2.2.19/drivers/video/offb.c Sat May 5 16:17:28 2001
+++ linux-2.2.19-patched/drivers/video/offb.c Sat May 5 16:07:41 2001
@@ -733,7 +733,7 @@
disp->scrollmode = SCROLL_YREDRAW;
strcpy(info->info.modename, "OFfb ");
- strncat(info->info.modename, full_name, sizeof(info->info.modename));
+ strncat(info->info.modename, full_name, sizeof(info->info.modename)
- 6);
info->info.node = -1;
info->info.fbops = &offb_ops;
info->info.disp = disp;
--->SNIP HERE<---
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Mon May 07 2001 - 21:00:22 EST