Am 15.11.2010 08:20, schrieb Dan Carpenter: > On Mon, Nov 15, 2010 at 07:56:05AM +0100, Geert Uytterhoeven wrote: >> On Mon, Nov 15, 2010 at 05:48, Paul Mundt <lethal@xxxxxxxxxxxx> wrote: >>> On Sat, Nov 13, 2010 at 01:07:18PM +0300, Dan Carpenter wrote: >>>> @@ -256,8 +264,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info) >>>> int rc, size = cmap->len * sizeof(u16); >>>> struct fb_cmap umap; >>>> >>>> + if (cmap->len * 2 > INT_MAX) >> >> Isn't that another integer overflow? I.e. should be "if (cmap->len > >> INT_MAX / sizeof(u16))" instead? >> > > Yeah it is. :/ > > I'll change it to: > if (size < 0 || size < cmap->len) > like Paul asked. > I do not see the rest of the code but it looks like cmap->len is size in int8_t. So the upper limit is something like INT_MAX/(sizeof(u16)*2). Perhaps we can call it a char ? is there ANY system that has a more than 256 colors in R|G|B ? <spying for struct fb_cmap_user > __u32 len; __u16 __user *red; So no need to check for <0. hope that helps, re, wh -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
