Dan Carpenter
fc6e0c3b90
xen-gntdev: integer overflow in gntdev_alloc_map()
...
The multiplications here can overflow resulting in smaller buffer
sizes than expected. "count" comes from a copy_from_user().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2011-11-16 12:13:46 -05:00
..
2011-10-31 19:32:11 -04:00
2011-11-16 12:13:08 -05:00
2011-01-20 16:37:28 -08:00
2011-11-16 12:13:43 -05:00
2010-10-18 10:40:28 -04:00
2009-12-11 12:18:16 -08:00
2011-11-06 20:13:34 -08:00
2011-04-10 17:01:05 +02:00
2008-12-16 21:50:31 +01:00
2011-03-09 22:15:28 -05:00
2011-11-16 12:13:46 -05:00
2011-11-06 20:13:34 -08:00
2011-09-29 10:52:16 -04:00
2011-09-29 10:52:16 -04:00
2011-10-31 19:32:11 -04:00
2011-11-06 20:13:34 -08:00
2011-02-25 16:43:03 +00:00
2011-10-31 19:32:11 -04:00
2011-05-19 11:30:41 -04:00
2011-06-17 15:06:20 -06:00
2011-07-29 13:45:45 -04:00
2011-10-25 09:17:47 +02:00
2010-03-30 22:02:32 +09:00