[PATCH] video: arcfb: fix buffer overflow

(count + p) is not checked for integer overflow.  If p < fbmemlength
and count = (size_t)(1 - p) (very big unsigned integer) then
count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)
overflows base_addr.

Signed-off-by: Vasiliy Kulikov <redacted>
---
 Compile tested only.

 drivers/video/arcfb.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 3ec4923..67a4cd4 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c

@@ -454,7 +454,7 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
 	xres = info->var.xres;
 	fbmemlength = (xres * info->var.yres)/8;
 
-	if (p > fbmemlength)
+	if (p > fbmemlength || (p + count < p))
 		return -ENOSPC;
 
 	err = 0;

-- 
1.7.0.4

On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote:

(count + p) is not checked for integer overflow.  If p < fbmemlength
and count = (size_t)(1 - p) (very big unsigned integer) then
count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)
overflows base_addr.

Signed-off-by: Vasiliy Kulikov <redacted>

Applied, thanks.

On Wed, Nov 24, 2010 at 03:25:58PM +0900, Paul Mundt wrote:

On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote:

quoted

(count + p) is not checked for integer overflow.  If p < fbmemlength
and count = (size_t)(1 - p) (very big unsigned integer) then
count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)
overflows base_addr.

Signed-off-by: Vasiliy Kulikov <redacted>

Applied, thanks.

The patch is harmless, but the integer overflow would actually be caught
in rw_verify_area().

regards,
dan carpenter

On Wed, Nov 24, 2010 at 09:46:49AM +0300, Dan Carpenter wrote:

On Wed, Nov 24, 2010 at 03:25:58PM +0900, Paul Mundt wrote:

quoted

On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote:

quoted

(count + p) is not checked for integer overflow.  If p < fbmemlength
and count = (size_t)(1 - p) (very big unsigned integer) then
count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)
overflows base_addr.

Signed-off-by: Vasiliy Kulikov <redacted>

Applied, thanks.

The patch is harmless, but the integer overflow would actually be caught
in rw_verify_area().

Ah, so it is, I'll drop it then, thanks.