Thread (5 messages) 5 messages, 3 authors, 2020-03-06

Re: [v4] vgacon: Fix a UAF in vgacon_invert_region

From: Linus Torvalds <torvalds@linux-foundation.org>
Date: 2020-03-06 13:24:28
Also in: dri-devel

On Fri, Mar 6, 2020 at 7:12 AM Daniel Vetter [off-list ref] wrote:
I'll stuff it into a pull and throw that your way, that's simplest.
Thanks.
btw we did add dri-devel to lore a while back, so should be there:
Indeed. I tried (incompetently) to look up your message ID, but I
didn't put the dri-devel part and saw the 404, and assumed it wasn't
there.

My bad.
quoted
It does strike me that there's nothing that seems to check for
overflow in the "(width << 1) * height" calculation. Hmm?
Indeed I failed to hunt for that :-/ But I think we're good, in
vc_do_resize() we have

    if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
        return -EINVAL;
Perfect. I just looked at the quoted patch itself.

            Linus
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help