diff mbox

video: arcfb: fix buffer overflow

Message ID 1290361202-15065-1-git-send-email-segoon@openwall.com (mailing list archive)
State Accepted
Commit e6ecbc286712e6e57932b918c0f199a2379b01f7
Headers show

Commit Message

Vasiliy Kulikov Nov. 21, 2010, 5:40 p.m. UTC 
None
diff mbox

Patch

diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 3ec4923..67a4cd4 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -454,7 +454,7 @@  static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
 	xres = info->var.xres;
 	fbmemlength = (xres * info->var.yres)/8;
 
-	if (p > fbmemlength)
+	if (p > fbmemlength || (p + count < p))
 		return -ENOSPC;
 
 	err = 0;