diff options
| author | Kees Cook <keescook@chromium.org> | 2013-03-11 17:31:45 -0700 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2013-03-13 21:31:03 +0100 |
| commit | 3118a4f652c7b12c752f3222af0447008f9b2368 (patch) | |
| tree | 22bc815888c57441e75528c14bd1d57aa4abdc37 /tools/perf/scripts/python | |
| parent | 2563a4524febe8f4a98e717e02436d1aaf672aa2 (diff) | |
drm/i915: bounds check execbuffer relocation count
It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.
CVE-2013-0913
v3: collapse test, improve comment
v2: move check into validate_exec_list
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Pinkie Pie
Cc: stable@vger.kernel.org
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions