diff for duplicates of <20101124065921.GH11705@linux-sh.org> diff --git a/a/1.txt b/N1/1.txt index dceede9..b3dd71a 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -2,8 +2,8 @@ On Wed, Nov 24, 2010 at 09:46:49AM +0300, Dan Carpenter wrote: > On Wed, Nov 24, 2010 at 03:25:58PM +0900, Paul Mundt wrote: > > On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote: > > > (count + p) is not checked for integer overflow. If p < fbmemlength -> > > and count = (size_t)(1 - p) (very big unsigned integer) then -> > > count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count) +> > > and count == (size_t)(1 - p) (very big unsigned integer) then +> > > count + p == 1 < fbmemlength and copy_to_user(base_addr+p, buf, count) > > > overflows base_addr. > > > > > > Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> diff --git a/a/content_digest b/N1/content_digest index 1648fe0..7b6acee 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -3,7 +3,7 @@ "ref\020101124064649.GQ1522@bicker\0" "From\0Paul Mundt <lethal@linux-sh.org>\0" "Subject\0Re: [PATCH] video: arcfb: fix buffer overflow\0" - "Date\0Wed, 24 Nov 2010 06:59:21 +0000\0" + "Date\0Wed, 24 Nov 2010 15:59:21 +0900\0" "To\0Dan Carpenter <error27@gmail.com>" Vasiliy Kulikov <segoon@openwall.com> kernel-janitors@vger.kernel.org @@ -16,8 +16,8 @@ "> On Wed, Nov 24, 2010 at 03:25:58PM +0900, Paul Mundt wrote:\n" "> > On Sun, Nov 21, 2010 at 08:40:01PM +0300, Vasiliy Kulikov wrote:\n" "> > > (count + p) is not checked for integer overflow. If p < fbmemlength\n" - "> > > and count = (size_t)(1 - p) (very big unsigned integer) then\n" - "> > > count + p = 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)\n" + "> > > and count == (size_t)(1 - p) (very big unsigned integer) then\n" + "> > > count + p == 1 < fbmemlength and copy_to_user(base_addr+p, buf, count)\n" "> > > overflows base_addr.\n" "> > > \n" "> > > Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>\n" @@ -29,4 +29,4 @@ "> \n" Ah, so it is, I'll drop it then, thanks. -8b6c53ace360c16aa7e96b7c2d093a3dc7b7c2dd52d407f2e7d08cd4a7541efb +1b18dbff69dbc0a22d8a53cb384b3be15ea13ec472cb650102f516bbb32f30f5
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.