Xi Wang bab9efc206 vmwgfx: integer overflow in vmw_kms_update_layout_ioctl() ... There are two issues in vmw_kms_update_layout_ioctl(). First, the for loop forgets to index rects and only checks the first element. Second, there is a potential integer overflow if userspace passes in a large arg->num_outputs. The call to kzalloc() would allocate a small buffer, leading to out-of-bounds read. Reported-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>		2011-12-02 10:49:41 +00:00
..
drm	vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()	2011-12-02 10:49:41 +00:00
stub	…
vga	drivers/gpu/vga/vgaarb.c: add missing kfree	2011-11-22 20:21:10 +00:00
Makefile	…