On Mon, Nov 15, 2010 at 07:56:05AM +0100, Geert Uytterhoeven wrote: > On Mon, Nov 15, 2010 at 05:48, Paul Mundt <lethal@xxxxxxxxxxxx> wrote: > > On Sat, Nov 13, 2010 at 01:07:18PM +0300, Dan Carpenter wrote: > >> @@ -256,8 +264,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info) > >> int rc, size = cmap->len * sizeof(u16); > >> struct fb_cmap umap; > >> > >> + if (cmap->len * 2 > INT_MAX) > > Isn't that another integer overflow? I.e. should be "if (cmap->len > > INT_MAX / sizeof(u16))" instead? > Yeah it is. :/ I'll change it to: if (size < 0 || size < cmap->len) like Paul asked. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
