projects / unionfs-2.6.39.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: dc33288) | patch
drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()
authorWenliang Fan <fanwlexca@gmail.com>
Tue, 17 Dec 2013 03:25:28 +0000 (11:25 +0800)
committerWilly Tarreau <w@1wt.eu>
Mon, 19 May 2014 05:54:08 +0000 (07:54 +0200)
commit7985df5a4f2b8431a831c3d4b12dff14e0efa12e
treefb1eaec61969f39775691fa34ea3c66293eef366tree | snapshot
parentdc332885abd71f603e01d8b27636a935c313d1c2commit | diff
drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()

[ Upstream commit e9db5c21d3646a6454fcd04938dd215ac3ab620a ]

The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/net/hamradio/hdlcdrv.c diff | blob | history
unionfs2-2.6.39.y