* [patch] [S390] keyboard: integer underflow bug
@ 2011-03-01 15:22 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2011-03-01 15:22 UTC (permalink / raw)
To: linux-s390, kernel-janitors
The "ct" variable should be an unsigned int. Both struct kbdiacrs
->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints.
Making it signed causes a problem in KBDIACRUC because the user could
set the signed bit and cause a buffer overflow.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index d667334..8065881 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -458,7 +458,8 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
int kbd_ioctl(struct kbd_data *kbd, unsigned int cmd, unsigned long arg)
{
void __user *argp;
- int ct, perm;
+ unsigned int ct;
+ int perm;
argp = (void __user *)arg;
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-03-01 15:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-01 15:22 [patch] [S390] keyboard: integer underflow bug Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.