Skip to content

Commit 9f645bc

Browse files
committed
video: uvesafb: Fix integer overflow in allocation
cmap->len can get close to INT_MAX/2, allowing for an integer overflow in allocation. This uses kmalloc_array() instead to catch the condition. Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com> Fixes: 8bdb3a2 ("uvesafb: the driver core") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
1 parent 353748a commit 9f645bc

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

Diff for: drivers/video/fbdev/uvesafb.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -1044,7 +1044,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
10441044
info->cmap.len || cmap->start < info->cmap.start)
10451045
return -EINVAL;
10461046

1047-
entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
1047+
entries = kmalloc_array(cmap->len, sizeof(*entries),
1048+
GFP_KERNEL);
10481049
if (!entries)
10491050
return -ENOMEM;
10501051

0 commit comments

Comments
 (0)