| From b652277b09d3d030cb074cc6a98ba80b34244c03 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <error27@gmail.com> |
| Date: Thu, 3 Mar 2011 17:56:06 +0100 |
| Subject: [S390] keyboard: integer underflow bug |
| |
| From: Dan Carpenter <error27@gmail.com> |
| |
| commit b652277b09d3d030cb074cc6a98ba80b34244c03 upstream. |
| |
| The "ct" variable should be an unsigned int. Both struct kbdiacrs |
| ->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints. |
| |
| Making it signed causes a problem in KBDIACRUC because the user could |
| set the signed bit and cause a buffer overflow. |
| |
| Signed-off-by: Dan Carpenter <error27@gmail.com> |
| Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/s390/char/keyboard.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/s390/char/keyboard.c |
| +++ b/drivers/s390/char/keyboard.c |
| @@ -460,7 +460,8 @@ kbd_ioctl(struct kbd_data *kbd, struct f |
| unsigned int cmd, unsigned long arg) |
| { |
| void __user *argp; |
| - int ct, perm; |
| + unsigned int ct; |
| + int perm; |
| |
| argp = (void __user *)arg; |
| |
