diff options
| author | Xi Wang <xi.wang@gmail.com> | 2011-11-25 15:58:58 -0500 |
|---|---|---|
| committer | Thomas Hellstrom <thellstrom@vmware.com> | 2011-11-28 12:28:30 +0100 |
| commit | f7a9281f263fb77a56243708d2c8f6421582448d (patch) | |
| tree | ab695624ebd177645afde4e2c7429d093a641ffb /vmwgfx_kms.c | |
| parent | a447d1e4d514a43e7554ad72d6b1b38f8914c1f7 (diff) | |
vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()
There are two issues in vmw_kms_update_layout_ioctl(). First, the
for loop forgets to index rects and only checks the first element.
Second, there is a potential integer overflow if userspace passes
in a large arg->num_outputs. The call to kzalloc() would allocate
a small buffer, leading to out-of-bounds read.
Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Diffstat (limited to 'vmwgfx_kms.c')
| -rw-r--r-- | vmwgfx_kms.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/vmwgfx_kms.c b/vmwgfx_kms.c index 506b4d5..b87afdf 100644 --- a/vmwgfx_kms.c +++ b/vmwgfx_kms.c @@ -1983,7 +1983,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, } rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect); - rects = kzalloc(rects_size, GFP_KERNEL); + rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect), + GFP_KERNEL); if (unlikely(!rects)) { ret = -ENOMEM; goto out_unlock; @@ -1998,10 +1999,10 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, } for (i = 0; i < arg->num_outputs; ++i) { - if (rects->x < 0 || - rects->y < 0 || - rects->x + rects->w > mode_config->max_width || - rects->y + rects->h > mode_config->max_height) { + if (rects[i].x < 0 || + rects[i].y < 0 || + rects[i].x + rects[i].w > mode_config->max_width || + rects[i].y + rects[i].h > mode_config->max_height) { DRM_ERROR("Invalid GUI layout.\n"); ret = -EINVAL; goto out_free; |