lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 8 Aug 2009 11:33:58 +0200 From: Jiri Slaby <jirislaby@...il.com> To: Greg Kroah-Hartman <gregkh@...e.de> Cc: pavel@....cz, swetland@...gle.com, ibm@...roid.com, san@...roid.com, linux-kernel@...r.kernel.org, Jiri Slaby <jirislaby@...il.com> Subject: [PATCH] Staging: dream, fix buf overflow Not even compile-tested. I don't have an arm toolchain. -- In vfe_send_msg_no_payload there is a wrong struct vfe_message allocation. It allocates only sizeof(pointer to vfe_message) for a whole structure. Add a dereference to the sizeof to allocate sizeof(vfe_message). Signed-off-by: Jiri Slaby <jirislaby@...il.com> --- drivers/staging/dream/camera/msm_vfe8x_proc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/staging/dream/camera/msm_vfe8x_proc.c b/drivers/staging/dream/camera/msm_vfe8x_proc.c index bb65013..5436f71 100644 --- a/drivers/staging/dream/camera/msm_vfe8x_proc.c +++ b/drivers/staging/dream/camera/msm_vfe8x_proc.c @@ -818,7 +818,7 @@ static void vfe_send_msg_no_payload(enum VFE_MESSAGE_ID id) { struct vfe_message *msg; - msg = kzalloc(sizeof(msg), GFP_ATOMIC); + msg = kzalloc(sizeof(*msg), GFP_ATOMIC); if (!msg) return; -- 1.6.3.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists