Re: some bluetooth fixes
From: Andi Kleen <hidden>
Date: 2004-02-11 19:55:01
On Wed, 11 Feb 2004 19:55:43 +0100 Marcel Holtmann [off-list ref] wrote:
Hi Andi,quoted
Doing size checks after the multiply is too late - they could have already overflowed. You have to check the raw value from the user.new patch is attached.
+ if (req.conn_num * sizeof(*ci) > PAGE_SIZE * 2) + return -EINVAL; This can still overflow. It should be if (req.conn_num > (PAGE_SIZE * 2)/sizeof(*ci)) return -EINVAL -Andi