diff options
| author | Dan Carpenter <[email protected]> | 2015-07-03 11:53:03 +0300 |
|---|---|---|
| committer | James Bottomley <[email protected]> | 2015-08-26 07:11:45 -0700 |
| commit | e819cdb198319cccf4af4fc12ac4d796109d8c23 (patch) | |
| tree | 5ebde58eb5e51eb6dc52149192e00ff9a13275e4 /lib/memory-notifier-error-inject.c | |
| parent | 8d6a9f5676f0e734967ac3739f5c6a28a0b047d9 (diff) | |
mptfusion: prevent some memory corruption
These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.
We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Johannes Thumshirn <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Diffstat (limited to 'lib/memory-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions