vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()
authorXi Wang <xi.wang@gmail.com>
Mon, 28 Nov 2011 11:25:43 +0000 (12:25 +0100)
committerDave Airlie <airlied@redhat.com>
Fri, 2 Dec 2011 10:49:41 +0000 (10:49 +0000)
commitbab9efc206ba89766c53a9042eb771e87e68c42b
tree7413fe6517587d631fca96960ec806d5e8b7e61a
parentf3a71df05082c84d1408129084736c5f742a6165
vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()

There are two issues in vmw_kms_update_layout_ioctl().  First, the
for loop forgets to index rects and only checks the first element.
Second, there is a potential integer overflow if userspace passes
in a large arg->num_outputs.  The call to kzalloc() would allocate
a small buffer, leading to out-of-bounds read.

Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c