fbdev: color map copying bounds checking
commit2dc705a993
upstream. Copying color maps to userspace doesn't check the value of to->start, which will cause kernel heap buffer OOB read due to signedness wraps. CVE-2016-8405 Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast Fixes:1da177e4c3
("Linux-2.6.12-rc2") Signed-off-by: Kees Cook <keescook@chromium.org> Reported-by: Peter Pi (@heisecode) of Trend Micro Cc: Min Chong <mchong@google.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
09f886dc5a
commit
544160b6ea
|
@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap)
|
|||
|
||||
int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
|
||||
{
|
||||
int tooff = 0, fromoff = 0;
|
||||
int size;
|
||||
unsigned int tooff = 0, fromoff = 0;
|
||||
size_t size;
|
||||
|
||||
if (to->start > from->start)
|
||||
fromoff = to->start - from->start;
|
||||
else
|
||||
tooff = from->start - to->start;
|
||||
size = to->len - tooff;
|
||||
if (size > (int) (from->len - fromoff))
|
||||
size = from->len - fromoff;
|
||||
if (size <= 0)
|
||||
if (fromoff >= from->len || tooff >= to->len)
|
||||
return -EINVAL;
|
||||
|
||||
size = min_t(size_t, to->len - tooff, from->len - fromoff);
|
||||
if (size == 0)
|
||||
return -EINVAL;
|
||||
size *= sizeof(u16);
|
||||
|
||||
|
@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
|
|||
|
||||
int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
|
||||
{
|
||||
int tooff = 0, fromoff = 0;
|
||||
int size;
|
||||
unsigned int tooff = 0, fromoff = 0;
|
||||
size_t size;
|
||||
|
||||
if (to->start > from->start)
|
||||
fromoff = to->start - from->start;
|
||||
else
|
||||
tooff = from->start - to->start;
|
||||
size = to->len - tooff;
|
||||
if (size > (int) (from->len - fromoff))
|
||||
size = from->len - fromoff;
|
||||
if (size <= 0)
|
||||
if (fromoff >= from->len || tooff >= to->len)
|
||||
return -EINVAL;
|
||||
|
||||
size = min_t(size_t, to->len - tooff, from->len - fromoff);
|
||||
if (size == 0)
|
||||
return -EINVAL;
|
||||
size *= sizeof(u16);
|
||||
|
||||
|
|
Loading…
Reference in a new issue