kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/message
History
Dan Carpenter 654484aa13 mptfusion: prevent some memory corruption 
[ Upstream commit e819cdb198 ]

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-12-03 10:04:59 -05:00
..
fusion mptfusion: prevent some memory corruption 2015-12-03 10:04:59 -05:00
i2o scsi: use 64-bit value for 'max_luns' 2014-07-17 22:07:38 +02:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00