Please sign in to comment.
drm: integer overflow in drm_mode_dirtyfb_ioctl()
There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if userspace passes in a large num_clips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption. Reported-by: Haogang Chen <firstname.lastname@example.org> Signed-off-by: Xi Wang <email@example.com> Cc: firstname.lastname@example.org Signed-off-by: Dave Airlie <email@example.com>
- Loading branch information...
Showing with 6 additions and 0 deletions.