parisc setup_sigcontext32() array overflows
From: Adrian Bunk
Date: Sat May 17 2008 - 15:18:41 EST
include/asm-parisc/ptrace.h:
<-- snip -->
...
struct pt_regs {
unsigned long gr[32]; /* PSW is in gr[0] */
...
}
<-- snip -->
arch/parisc/kernel/signal32.c:
<-- snip -->
...
setup_sigcontext32(struct compat_sigcontext __user *sc, struct compat_regfile __user * rf,
struct pt_regs *regs, int in_syscall)
{
...
/* Store upper half */
compat_reg = (compat_uint_t)(regs->gr[32] >> 32);
... ^^
/* Store upper half */
compat_reg = (compat_uint_t)((regs->gr[32]+4) >> 32);
... ^^
<-- snip -->
Spotted by the GNU C compiler.
cu
Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/