Xi Wang 61aff74833 drm: integer overflow in drm_mode_dirtyfb_ioctl() ... commit a5cd335165 upstream. There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if userspace passes in a large num_clips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption. Reported-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2011-12-09 08:52:20 -08:00
..
drm	drm: integer overflow in drm_mode_dirtyfb_ioctl()	2011-12-09 08:52:20 -08:00
stub	i915: select VIDEO_OUTPUT_CONTROL for ACPI_VIDEO	2011-04-13 09:10:25 +10:00
vga	Merge branch 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6	2011-05-24 12:06:40 -07:00
Makefile	gpu: Add Intel GMA500(Poulsbo) Stub Driver	2010-10-26 11:00:13 +10:00