Hi,
Buffer overflow found in drivers/video/fbmem.c.
[Version]:Newest
[Detail]:
1592 static int do_register_framebuffer(struct fb_info *fb_info)
1593 {
1594 | int i;
1595 | struct fb_event event;
1596 | struct fb_videomode mode;
........
1607 | num_registered_fb++;
1608 | for (i = 0 ; i < FB_MAX; i++) //******* i could be FB_MAX
after loop *********/
1609 | | if (!registered_fb[i])
1610 | | | break;
........
1646 | fb_var_to_videomode(&mode, &fb_info->var);
1647 | fb_add_videomode(&mode, &fb_info->modelist);
1648 | registered_fb[i] = fb_info; // ****** Here will be a
off-by-one overflow *******/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
