keyboard: integer underflow bug

PATCH New Dan Carpenter 1 participant 1 message Mar 1, 2011

Subsystems (2)

Kernel janitors s390

lore

Share & tools

lore

Dan Carpenter

author

2011-03-01 15:22 UTC #0 lore raw

PATCH 1/1 keyboard: integer underflow bug

The "ct" variable should be an unsigned int. Both struct kbdiacrs ->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints.

Making it signed causes a problem in KBDIACRUC because the user could set the signed bit and cause a buffer overflow.

Signed-off-by Dan Carpenter <[email protected]>

drivers/s390/char/keyboard.c +2 -1

index d667334..8065881 100644
@@ -458,7 +458,8 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 int kbd_ioctl(struct kbd_data *kbd, unsigned int cmd, unsigned long arg)
 {
 	void __user *argp;
-	int ct, perm;
+	unsigned int ct;
+	int perm;
 
 	argp = (void __user *)arg;