Messages in this thread |  | | Date | Tue, 27 Jul 2021 07:35:28 +0200 | From | "" <> | Subject | Re: [Internet]Re: [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check |
| |
On Tue, Jul 27, 2021 at 01:53:13AM +0000, tcs_kernel(腾讯云内核开发者) wrote: > yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range. > This is an out-of-bounds write bug. > I think updatescrollmode is the right place to validate values supplied by a user ioctl, because only here makes --operation,and 0 is a legal value before that.
Please wrap your changelog text.
> > Signed-off-by: Tencent Cloud System tcs_kernel@tencent.com
That is not the name of a person :(
And the format isn't correct, so there's nothing we can do with this patch, and the patch itself is corrupted and could not be applied :(
Also, what about checking these values earlier? How can the value be 0 earlier and be acceptable? Putting bounds on the user-provided values would be much easier, right?
thanks,
greg k-h
|  |