diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-12-23 12:56:49 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2015-01-05 12:10:08 -0500 |
| commit | dd5a74f2f982193620cfa1ef609df1ee805781d4 (patch) | |
| tree | 6ea42eebf713a63abc6f40492b512f54cba42d38 /drivers/isdn/mISDN/clock.c | |
| parent | 02ae7af53a451a1b0a51022c4693f5b339133e79 (diff) | |
drm/radeon: integer underflow in radeon_cp_dispatch_texture()
The test:
if (size > RADEON_MAX_TEXTURE_SIZE) {
"size" is an integer and it's controled by the user so it can be
negative and the test can underflow. Later we use "size" in:
dwords = size / 4;
...
RADEON_COPY_MT(buffer, data, (int)(dwords * sizeof(u32)));
It causes memory corruption to copy a negative size buffer.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/isdn/mISDN/clock.c')
0 files changed, 0 insertions, 0 deletions