Kees Cook 9aa818d42b video: uvesafb: Fix integer overflow in allocation ...

commit 9f645bcc56 upstream.

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7d ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-07-03 11:25:02 +02:00

..

backlight

backlight: tps65217_bl: Fix Device Tree node lookup

2018-07-03 11:25:00 +02:00

console

vgacon: Set VGA struct resource types

2018-03-24 11:01:25 +01:00

fbdev

video: uvesafb: Fix integer overflow in allocation

2018-07-03 11:25:02 +02:00

logo

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

display_timing.c

…

hdmi.c

video/hdmi: Allow "empty" HDMI infoframes

2018-03-19 08:42:47 +01:00

Kconfig

fbdev: sh_mipi_dsi: remove driver

2016-05-10 11:53:38 +03:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

of_display_timing.c

video: fbdev: Convert to using %pOF instead of full_name

2017-08-07 17:22:13 +02:00

of_videomode.c

video: fbdev: Convert to using %pOF instead of full_name

2017-08-07 17:22:13 +02:00

vgastate.c

fbdev: vgastate: remove trailing whitespaces

2015-01-13 12:53:25 +02:00

videomode.c

…