Kees Cook 9f645bcc56 video: uvesafb: Fix integer overflow in allocation ...

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7df48 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>

2018-06-12 16:19:22 -07:00

..

backlight

backlight: as3711_bl: Fix Device Tree node leaks

2018-06-11 13:40:45 +01:00

console

fbdev changes for v4.17:

2018-04-10 10:20:00 -07:00

fbdev

video: uvesafb: Fix integer overflow in allocation

2018-06-12 16:19:22 -07:00

logo

video/logo: remove obsolete logo files

2018-03-26 15:56:42 +02:00

display_timing.c

…

hdmi.c

video/hdmi: Reject illegal picture aspect ratios

2018-05-11 09:04:25 +02:00

Kconfig

fbdev changes for v4.17:

2018-04-10 10:20:00 -07:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

of_display_timing.c

video: of: display_timing: Remove of_display_timings_exist() function

2018-03-12 17:06:54 +01:00

of_videomode.c

video: fbdev: Convert to using %pOF instead of full_name

2017-08-07 17:22:13 +02:00

vgastate.c

…

videomode.c

…