raghavendra ambadas ddea3574a6 fbdev: msm: check the length of the external input buffer properly ... dchdr->dlen is a short variable controlled by the user-provided data. If the value is negative, loop continues, also increasing the value of "len". As a result buffer overflow occurs. So define the len as unsigned and check with length of string input from user space. Change-Id: I8bb9ab33d543c826eb330e16ae116385d823ca98 Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>		2019-07-27 22:11:31 +02:00
..
adf	adf: Zero out the mapping data	2016-09-06 12:57:24 -07:00
aty
backlight
console	fbcon: queue work on power efficient wq	2019-07-27 22:11:02 +02:00
exynos
geode
i810
intelfb
kyro
logo	video/logo: prevent use of logos after they have been freed	2015-01-27 07:52:31 -08:00
matrox
mb862xx
mbx
mmp
msm	fbdev: msm: check the length of the external input buffer properly	2019-07-27 22:11:31 +02:00
nvidia
omap
omap2
riva
savage
sis
vermilion
via
68328fb.c
acornfb.c
acornfb.h
amba-clcd.c
amifb.c
arcfb.c
arkfb.c
asiliantfb.c
atafb.c
atafb.h
atafb_iplan2p2.c
atafb_iplan2p4.c
atafb_iplan2p8.c
atafb_mfb.c
atafb_utils.h
atmel_lcdfb.c
au1100fb.c
au1100fb.h
au1200fb.c
au1200fb.h
auo_k190x.c
auo_k190x.h
auo_k1900fb.c
auo_k1901fb.c
bf54x-lq043fb.c
bf537-lq035.c
bfin-lq035q1-fb.c
bfin-t350mcqb-fb.c
bfin_adv7393fb.c
bfin_adv7393fb.h
broadsheetfb.c
bt431.h
bt455.h
bw2.c
c2p.h
c2p_core.h
c2p_iplan2.c
c2p_planar.c
carminefb.c
carminefb.h
carminefb_regs.h
cfbcopyarea.c
cfbfillrect.c
cfbimgblt.c
cg3.c
cg6.c
cg14.c
chipsfb.c
cirrusfb.c
clps711xfb.c
cobalt_lcdfb.c
controlfb.c
controlfb.h
cyber2000fb.c
cyber2000fb.h
da8xx-fb.c	fbdev: da8xx-fb: fix videomodes of lcd panels	2016-06-07 10:42:51 +02:00
display_timing.c
dnfb.c
edid.h
efifb.c
ep93xx-fb.c
fb-puv3.c
fb_ddc.c
fb_defio.c
fb_draw.h
fb_notify.c
fb_sys_fops.c
fbcmap.c	fbdev: color map copying bounds checking	2017-04-22 23:02:55 +02:00
fbcvt.c
fbmem.c	fbdev: fbmem: fix memory access if logo is bigger than the screen	2019-07-27 22:10:04 +02:00
fbmon.c
fbsysfs.c	fb: reorder the lock sequence to fix potential dead lock	2019-07-27 22:09:10 +02:00
ffb.c
fm2fb.c
fsl-diu-fb.c
g364fb.c
gbefb.c
goldfishfb.c	video: fbdev: Set pixclock = 0 in goldfishfb	2019-07-27 22:08:57 +02:00
grvga.c
gxt4500.c
hdmi.c
hecubafb.c
hgafb.c
hitfb.c
hpfb.c
hyperv_fb.c
i740_reg.h
i740fb.c
igafb.c
imsttfb.c
imxfb.c
jz4740_fb.c
Kconfig
leo.c
macfb.c
macmodes.c
macmodes.h
Makefile
maxinefb.c
metronomefb.c
modedb.c
mx3fb.c
mxsfb.c
n411.c
neofb.c
nuc900fb.c
nuc900fb.h
of_display_timing.c
of_videomode.c
offb.c
output.c
p9100.c
platinumfb.c
platinumfb.h
pm2fb.c
pm3fb.c
pmag-aa-fb.c
pmag-ba-fb.c
pmagb-b-fb.c
ps3fb.c
pvr2fb.c
pxa3xx-gcu.c
pxa3xx-gcu.h
pxa168fb.c
pxa168fb.h
pxafb.c
pxafb.h
q40fb.c
s1d13xxxfb.c
s3c-fb.c
s3c2410fb.c
s3c2410fb.h
s3fb.c
sa1100fb.c
sa1100fb.h
sbuslib.c
sbuslib.h
sgivwfb.c
sh7760fb.c
sh_mipi_dsi.c
sh_mobile_hdmi.c
sh_mobile_lcdcfb.c	fb: reorder the lock sequence to fix potential dead lock	2019-07-27 22:09:10 +02:00
sh_mobile_lcdcfb.h
sh_mobile_meram.c
simplefb.c
skeletonfb.c
sm501fb.c
smscufx.c
ssd1307fb.c
sstfb.c
sticore.h
stifb.c
sunxvr500.c
sunxvr1000.c
sunxvr2500.c
svgalib.c
syscopyarea.c
sysfillrect.c
sysimgblt.c
tcx.c
tdfxfb.c
tgafb.c
tmiofb.c
tridentfb.c
udlfb.c
uvesafb.c
valkyriefb.c
valkyriefb.h
vesafb.c
vfb.c
vga16fb.c
vgastate.c
videomode.c
vt8500lcdfb.c
vt8500lcdfb.h
vt8623fb.c
w100fb.c
w100fb.h
wm8505fb.c
wm8505fb_regs.h
wmt_ge_rops.c
wmt_ge_rops.h
xen-fbfront.c
xilinxfb.c