diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2016-06-28 00:12:34 +0300 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2016-08-19 10:50:49 +0300 |
| commit | f401ce4c9afa03f8d8c3df6268e167a147906474 (patch) | |
| tree | 18aa01dbdeccd379a1429486b48780174888409e /sound | |
| parent | 56008dd66cc01642b871d2897a76ea194cf1b082 (diff) | |
| download | linux-f401ce4c9afa03f8d8c3df6268e167a147906474.tar.xz | |
tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.
The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do
sym = U(key_maps[0][k]);
with large 'k'.
To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.
Also while at it let's switch to for_each_set_bit() instead of open-coding
it.
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'sound')
0 files changed, 0 insertions, 0 deletions