Displaying 3 results from an estimated 3 matches for "gref_siz".
Did you mean:
gref_size
2011 Nov 04
1
[patch 1/2] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected. If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
index f6832f4..23c60cf 100644
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xe...
2011 Nov 04
1
[patch 1/2] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected. If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
index f6832f4..23c60cf 100644
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xe...
2011 Nov 04
1
[patch 1/2] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected. If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
index f6832f4..23c60cf 100644
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xe...