Skip to content
Commit e9db5c21 authored by Wenliang Fan's avatar Wenliang Fan Committed by David S. Miller
Browse files

drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()



The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
	s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

Signed-off-by: default avatarWenliang Fan <fanwlexca@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0c8d087c
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment