Description
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer size calculation `fb_size = linebytes * height` can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow. Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to < 0cec951667a624fafaca2695c46042f45851caecaffectedc8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to < 711fe7949d37656a5586244afee9523b9e5e37e9affectedc8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to < ded6ad826fe0fd059333d3a3b3e1742c8e45ff41affectedc8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to < d9daf9a6e7a6f82ef338a09386eefc6807100d3faffectedc8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to < c6f48e59ece0123f6a11527ad4d89b21c2d65b87affected
Linux Linux
Default version status: affected
6.2affected0 to < 6.2unaffected6.6.160 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0cec951667a624fafaca2695c46042f45851caec ↗
- https://git.kernel.org/stable/c/711fe7949d37656a5586244afee9523b9e5e37e9 ↗
- https://git.kernel.org/stable/c/ded6ad826fe0fd059333d3a3b3e1742c8e45ff41 ↗
- https://git.kernel.org/stable/c/d9daf9a6e7a6f82ef338a09386eefc6807100d3f ↗
- https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87 ↗