diff options
| author | Dan Carpenter <[email protected]> | 2014-12-23 09:56:49 +0000 |
|---|---|---|
| committer | Alex Deucher <[email protected]> | 2015-01-05 17:10:08 +0000 |
| commit | dd5a74f2f982193620cfa1ef609df1ee805781d4 (patch) | |
| tree | 6ea42eebf713a63abc6f40492b512f54cba42d38 /lib/mpi/mpi-cmp.c | |
| parent | drm/radeon: adjust default bapm settings for KV (diff) | |
| download | kernel-dd5a74f2f982193620cfa1ef609df1ee805781d4.tar.gz kernel-dd5a74f2f982193620cfa1ef609df1ee805781d4.zip | |
drm/radeon: integer underflow in radeon_cp_dispatch_texture()
The test:
if (size > RADEON_MAX_TEXTURE_SIZE) {
"size" is an integer and it's controled by the user so it can be
negative and the test can underflow. Later we use "size" in:
dwords = size / 4;
...
RADEON_COPY_MT(buffer, data, (int)(dwords * sizeof(u32)));
It causes memory corruption to copy a negative size buffer.
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Diffstat (limited to 'lib/mpi/mpi-cmp.c')
0 files changed, 0 insertions, 0 deletions