Re: some bluetooth fixes

[Andi Kleen <ak@xxxxxxx>]

On Wed, 11 Feb 2004 19:55:43 +0100
Marcel Holtmann <marcel@xxxxxxxxxxxx> wrote:

> Hi Andi,
> 
> > Doing size checks after the multiply is too late - they could
> > have already overflowed. You have to check the raw value from the user.
> 
> new patch is attached.


+       if (req.conn_num * sizeof(*ci) > PAGE_SIZE * 2)
+               return -EINVAL;

This can still overflow. It should be 

        if (req.conn_num > (PAGE_SIZE * 2)/sizeof(*ci))
                return -EINVAL

-Andi