Re: some bluetooth fixes
From: Andi Kleen <hidden>
Date: 2004-02-14 23:25:13
Also in:
linux-bluetooth
On Wed, 11 Feb 2004 19:55:43 +0100 Marcel Holtmann [off-list ref] wrote:
Hi Andi,quoted
Doing size checks after the multiply is too late - they could have already overflowed. You have to check the raw value from the user.new patch is attached.
+ if (req.conn_num * sizeof(*ci) > PAGE_SIZE * 2) + return -EINVAL; This can still overflow. It should be if (req.conn_num > (PAGE_SIZE * 2)/sizeof(*ci)) return -EINVAL -Andi ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click