Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 03:13:16PM +0800, Wenliang Fan wrote: The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'.

Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 06:19:56PM +0800, Wenliang Fan wrote: The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'.

[PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Wenliang Fan
The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan fanwle...@gmail.com ---

Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 07:07:38PM +0800, Wenliang Fan wrote: The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'.

[PATCH] drivers/staging/bcm: Integer overflow

2013-12-19 Thread Wenliang Fan
The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan fanwle...@gmail.com ---