| commit | 0f22072ab50cac7983f9660d33974b45184da4f9 | [log] [tgz] |
|---|---|---|
| author | Dan Rosenberg <drosenberg@vsecurity.com> | Fri Apr 29 15:48:07 2011 +0100 |
| committer | Russell King <rmk+kernel@arm.linux.org.uk> | Fri Apr 29 15:53:14 2011 +0100 |
| tree | 59c175c63787b9b0424c40064df02cda7fe72a24 | |
| parent | 408133e9dca2b94c64b917b144ec816df913a94e [diff] |
ARM: 6891/1: prevent heap corruption in OABI semtimedop When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not bound the nsops argument. A sufficiently large value will cause an integer overflow in allocation size, followed by copying too much data into the allocated buffer. Fix this by restricting nsops to SEMOPM. Untested. Cc: stable@kernel.org Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>