Re: [patch] gdth: integer overflow in ioctl

[Dan Carpenter]

On Fri, Oct 08, 2010 at 09:03:07AM +0200, Dan Carpenter wrote:
> gdth_ioctl_alloc() takes the size variable as an int.
> copy_from_user() takes the size variable as an unsigned long.
> gen.data_len and gen.sense_len are unsigned longs.
> On x86_64 longs are 64 bit and ints are 32 bit.
> 
> We could pass in a very large number and the allocation would truncate
> the size to 32 bits and allocate a small buffer.  Then when we do the
> copy_from_user(), it would result in a memory corruption.
> 
> CC: stable@xxxxxxxxxx
> Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
> 

I never know if anyone gets my emails and so I has a small sad face on
the front of my head here: --------------->   :(

regards,
dan carpenter


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/