| commit | 41a832836d268172869e1ac965596b472dd13a92 | |
| author | Dan Rosenberg <drosenberg@vsecurity.com> | |
| Fri, 29 Apr 2011 14:48:07 +0000 (29 15:48 +0100) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 9 May 2011 23:04:44 +0000 (9 16:04 -0700) | ||
| tree | a0accdb3c171890daf9e0bb573095b89c9024c35 | treesnapshot (tar.gz zip) |
| parent | 4f31bed380488d4e870cd696b5f9cfc5bb8656de | commitdiff |
ARM: 6891/1: prevent heap corruption in OABI semtimedop
commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.
When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument. A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer. Fix this by restricting nsops to SEMOPM.
Untested.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.
When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument. A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer. Fix this by restricting nsops to SEMOPM.
Untested.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| arch/arm/kernel/sys_oabi-compat.c | diffblobblamehistory |