VMCI: integer overflow in vmci_datagram_dispatch()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 29 Aug 2014 08:42:56 +0000 (11:42 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 24 Sep 2014 06:26:42 +0000 (23:26 -0700)
This is untrusted user data from vmci_host_do_send_datagram() so the
VMCI_DG_SIZE() macro can have an integer overflow.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

No differences found