Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

[Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>]

On 27 Jun 2005, at 21:00, Chris Wright wrote:

> > The check happens in set_gdt(). do_set_gdt is just a wrapper with a
> > copy_from_user plus conditional tlb flush.
> I know, but copy_from_user has no sane limits.  This is stack smash.
> -chris
Good point.

 -- Keir


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel