diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2020-01-10 02:11:00 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2020-01-10 02:11:00 +0000 |
| commit | efb7618869e924047f35c4b976f6d4a87241f7d9 (patch) | |
| tree | 99b9b9cea981bdb134c1df184f597b8b919bc3c6 | |
| parent | 6d0645c81076ea418ad7b066dd8ee797a967b95d (diff) | |
drm: limit to INT_MAX in create_blob ioctl
From Daniel Vetter
85b1e127aa577f7035b998b8c712bb6a36f02b14 in linux 4.19.y/4.19.94
5bf8bec3f4ce044a223c40cbce92590d938f0e9c in mainline linux
| -rw-r--r-- | sys/dev/pci/drm/drm_property.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/pci/drm/drm_property.c b/sys/dev/pci/drm/drm_property.c index cdb10f885a4..69dfed57c2f 100644 --- a/sys/dev/pci/drm/drm_property.c +++ b/sys/dev/pci/drm/drm_property.c @@ -556,7 +556,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, struct drm_property_blob *blob; int ret; - if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob)) + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); |