diff for duplicates of <20101124062558.GF11705@linux-sh.org> diff --git a/a/1.txt b/N1/1.txt index 89d0515..3bf3507 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,7 +1,7 @@ On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote: > (count + p) is not checked for integer overflow. If p < fbmemlength -> and count = (size_t)(1 - p) (very big unsigned integer) then -> count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count) +> and count == (size_t)(1 - p) (very big unsigned integer) then +> count + p == 1 < fbmemlength and copy_to_user(base_addr+p, buf, count) > overflows base_addr. > > Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> diff --git a/a/content_digest b/N1/content_digest index 8c6a8e5..9327376 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,7 +1,7 @@ "ref\01290361202-15065-1-git-send-email-segoon@openwall.com\0" "From\0Paul Mundt <lethal@linux-sh.org>\0" "Subject\0Re: [PATCH] video: arcfb: fix buffer overflow\0" - "Date\0Wed, 24 Nov 2010 06:25:58 +0000\0" + "Date\0Wed, 24 Nov 2010 15:25:58 +0900\0" "To\0Vasiliy Kulikov <segoon@openwall.com>\0" "Cc\0kernel-janitors@vger.kernel.org" Jaya Kumar <jayalk@intworks.biz> @@ -11,12 +11,12 @@ "b\0" "On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote:\n" "> (count + p) is not checked for integer overflow. If p < fbmemlength\n" - "> and count = (size_t)(1 - p) (very big unsigned integer) then\n" - "> count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)\n" + "> and count == (size_t)(1 - p) (very big unsigned integer) then\n" + "> count + p == 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)\n" "> overflows base_addr.\n" "> \n" "> Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>\n" "\n" Applied, thanks. -225e92b50ba6d78b703fa02fea4a8deb96ff38c4d829734a748cc858a7e553c5 +d7fb980fe1a1c008cc8885ff73f204c70efa4cb2f83e1377aa410ec883a7abcf
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.