Wenliang Fan e9db5c21d3 drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl() ...

The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
	s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2013-12-19 15:02:14 -05:00

21 KiB

Raw Blame History

View Raw