diff options
| author | Lee Jones <joneslee@google.com> | 2022-12-23 08:27:54 +0000 |
|---|---|---|
| committer | mdb:android-git <superproject-auto-update@invalid> | 2022-12-27 18:30:53 +0000 |
| commit | e992d8675a02100d697cac093e32db02e25209ed (patch) | |
| tree | 075a0f16aca6aadde828897534e0bb361626cfca | |
| parent | c694d656254acee0b1d9f764cf3aee52f076bf61 (diff) | |
| download | superproject-common-android12-5.10-2022-06.tar.gz | |
UPSTREAM: video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_writecommon-android12-5.10-2022-06
[ Upstream commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 ]
In pxa3xx_gcu_write, a count parameter of type size_t is passed to words of
type int. Then, copy_from_user() may cause a heap overflow because it is used
as the third argument of copy_from_user().
Bug: 245928838
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I9e21917a52e2cb78cc640a77a6eba21838aa8655
Signed-off-by: Lee Jones <joneslee@google.com>
| m--------- | common | 0 |
1 files changed, 0 insertions, 0 deletions
diff --git a/common b/common -Subproject 4445c2c797229fc14b0a65f359f8ed077f13e60 +Subproject 737961790eacb78c6ceb83d800cfad2941556b5 |