diff options
author | Xi Wang <xi.wang@gmail.com> | 2011-11-28 12:25:43 +0100 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2011-12-02 10:49:41 +0000 |
commit | bab9efc206ba89766c53a9042eb771e87e68c42b (patch) | |
tree | 7413fe6517587d631fca96960ec806d5e8b7e61a /scripts/show_delta | |
parent | f3a71df05082c84d1408129084736c5f742a6165 (diff) |
vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()
There are two issues in vmw_kms_update_layout_ioctl(). First, the
for loop forgets to index rects and only checks the first element.
Second, there is a potential integer overflow if userspace passes
in a large arg->num_outputs. The call to kzalloc() would allocate
a small buffer, leading to out-of-bounds read.
Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'scripts/show_delta')
0 files changed, 0 insertions, 0 deletions