e384a41141
There is an integer overflow here that could cause memory corruption
on 32 bit systems.
insnlist.n_insns could be a very high value size calculation for
kmalloc() could overflow resulting in a smaller "insns" than
expected. In the for (i = 0; i < insnlist.n_insns; i++) {... loop
we would read past the end of the buffer, possibly corrupting memory
as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
|
||
|---|---|---|
| .. | ||
| drivers | ||
| kcomedilib | ||
| comedi_compat32.c | ||
| comedi_compat32.h | ||
| comedi_fops.c | ||
| comedi_fops.h | ||
| comedi.h | ||
| comedidev.h | ||
| comedilib.h | ||
| drivers.c | ||
| internal.h | ||
| Kconfig | ||
| Makefile | ||
| proc.c | ||
| range.c | ||
| TODO | ||