| commit | d912e785e25fb48bc4eae43c497430b1d5b7e044 | |
| author | Dan Rosenberg <drosenberg@vsecurity.com> | |
| Wed, 15 Sep 2010 23:08:24 +0000 (15 19:08 -0400) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 27 Sep 2010 00:21:31 +0000 (26 17:21 -0700) | ||
| tree | f123b561174dd727ebeabfcffaca4f9ec4215392 | treesnapshot (tar.gz zip) |
| parent | 043d7866aebbc60a37dc3245035aee41836eb9be | commitdiff |
drivers/video/via/ioctl.c: prevent reading uninitialized stack memory
commit b4aaa78f4c2f9cde2f335b14f4ca30b01f9651ca upstream.
The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246
bytes of uninitialized stack memory, because the "reserved" member of
the viafb_ioctl_info struct declared on the stack is not altered or
zeroed before being copied back to the user. This patch takes care of
it.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit b4aaa78f4c2f9cde2f335b14f4ca30b01f9651ca upstream.
The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246
bytes of uninitialized stack memory, because the "reserved" member of
the viafb_ioctl_info struct declared on the stack is not altered or
zeroed before being copied back to the user. This patch takes care of
it.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| drivers/video/via/ioctl.c | diffblobblamehistory |