* [patch] [S390] keyboard: integer underflow bug
@ 2011-03-01 15:22 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2011-03-01 15:22 UTC (permalink / raw)
To: linux-s390, kernel-janitors
The "ct" variable should be an unsigned int. Both struct kbdiacrs
->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints.
Making it signed causes a problem in KBDIACRUC because the user could
set the signed bit and cause a buffer overflow.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index d667334..8065881 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -458,7 +458,8 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
int kbd_ioctl(struct kbd_data *kbd, unsigned int cmd, unsigned long arg)
{
void __user *argp;
- int ct, perm;
+ unsigned int ct;
+ int perm;
argp = (void __user *)arg;
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-03-01 15:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-01 15:22 [patch] [S390] keyboard: integer underflow bug Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox