From: Xi Wang <xi.wang@gmail.com>
Date: Wed, 30 Nov 2011 02:52:46 +0000 (-0500)
Subject: staging: vt6655: integer overflows in private_ioctl()
X-Git-Tag: v3.3-rc1~152^2~101^2~150
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2a58b19fd97c7368c03c027419a2aeb26313adad;p=pandora-kernel.git

staging: vt6655: integer overflows in private_ioctl()

There are two potential integer overflows in private_ioctl() if
userspace passes in a large sList.uItem / sNodeList.uItem.  The
subsequent call to kmalloc() would allocate a small buffer, leading
to a memory corruption.

Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

Reading git-diff-tree failed