On 12-Dec-18 11:10 AM, Yongseok Koh wrote:
malloc_elem_find_max_iova_contig() could return invalid size due to a
missing sanity check. The following gdb output shows how 'cur_size' can be
invalid in find_biggest_element().
(gdb) p/x cur_size
$4 = 0xffe42900
(gdb)
malloc_elem_find_max_iova_contig() could return invalid size due to a
missing sanity check. The following gdb output shows how 'cur_size' can be
invalid in find_biggest_element().
(gdb) p/x cur_size
$4 = 0xffe42900
(gdb) p elem
$1 = (struct malloc_elem *) 0x
2 matches
Mail list logo