Kees Cook 7673ca3c93 video: uvesafb: Fix integer overflow in allocation ...

commit 9f645bcc56 upstream.

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7d ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-07-03 11:23:16 +02:00

..

backlight

backlight: tps65217_bl: Fix Device Tree node lookup

2018-07-03 11:23:14 +02:00

console

vgacon: Set VGA struct resource types

2018-03-24 11:00:25 +01:00

fbdev

video: uvesafb: Fix integer overflow in allocation

2018-07-03 11:23:16 +02:00

logo

treewide: replace obsolete _refok by __ref

2016-08-02 17:31:41 -04:00

display_timing.c

video: add display_timing and videomode

2013-01-24 09:03:04 +01:00

hdmi.c

video/hdmi: Allow "empty" HDMI infoframes

2018-03-22 09:17:53 +01:00

Kconfig

fbdev: sh_mipi_dsi: remove driver

2016-05-10 11:53:38 +03:00

Makefile

video: move fbdev to drivers/video/fbdev

2014-04-17 08:10:19 +03:00

of_display_timing.c

video: of: fix memory leak

2015-10-07 14:13:59 +03:00

of_videomode.c

video: Fix possible leak in of_get_videomode()

2015-08-10 15:11:12 +03:00

vgastate.c

fbdev: vgastate: remove trailing whitespaces

2015-01-13 12:53:25 +02:00

videomode.c

videomode: videomode_from_timing work

2013-03-21 14:34:33 +02:00