A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-16 09:43:28 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/drivers/gpu
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Xi Wang bab9efc206 vmwgfx: integer overflow in vmw_kms_update_layout_ioctl() 
There are two issues in vmw_kms_update_layout_ioctl().  First, the
for loop forgets to index rects and only checks the first element.
Second, there is a potential integer overflow if userspace passes
in a large arg->num_outputs.  The call to kzalloc() would allocate
a small buffer, leading to out-of-bounds read.

Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-12-02 10:49:41 +00:00
..
drm vmwgfx: integer overflow in vmw_kms_update_layout_ioctl() 2011-12-02 10:49:41 +00:00
stub
vga drivers/gpu/vga/vgaarb.c: add missing kfree 2011-11-22 20:21:10 +00:00
Makefile