mirror of https://github.com/torvalds/linux.git
2dc705a993
Copying color maps to userspace doesn't check the value of to->start,
which will cause kernel heap buffer OOB read due to signedness wraps.
CVE-2016-8405
Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| cfbcopyarea.c | ||
| cfbfillrect.c | ||
| cfbimgblt.c | ||
| fb_cmdline.c | ||
| fb_ddc.c | ||
| fb_defio.c | ||
| fb_draw.h | ||
| fb_notify.c | ||
| fb_sys_fops.c | ||
| fbcmap.c | ||
| fbcvt.c | ||
| fbmem.c | ||
| fbmon.c | ||
| fbsysfs.c | ||
| modedb.c | ||
| svgalib.c | ||
| syscopyarea.c | ||
| sysfillrect.c | ||
| sysimgblt.c | ||