Re: [v4] vgacon: Fix a UAF in vgacon_invert_region
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: 2020-03-06 13:24:28
Also in:
dri-devel
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: 2020-03-06 13:24:28
Also in:
dri-devel
On Fri, Mar 6, 2020 at 7:12 AM Daniel Vetter [off-list ref] wrote:
I'll stuff it into a pull and throw that your way, that's simplest.
Thanks.
btw we did add dri-devel to lore a while back, so should be there:
Indeed. I tried (incompetently) to look up your message ID, but I didn't put the dri-devel part and saw the 404, and assumed it wasn't there. My bad.
quoted
It does strike me that there's nothing that seems to check for overflow in the "(width << 1) * height" calculation. Hmm?Indeed I failed to hunt for that :-/ But I think we're good, in vc_do_resize() we have if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL;
Perfect. I just looked at the quoted patch itself.
Linus