[PATCH] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c

[PATCH] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c

[Denis Kirjanov]

Fix potential initial_lfsr buffer overrun.
Writing past the end of the buffer could happen when index == ENTRIES

Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org>
---
 arch/powerpc/oprofile/op_model_cell.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/powerpc/oprofile/op_model_cell.c b/arch/powerpc/oprofile/op_model_cell.c
index 2c9e522..7fd90d0 100644
--- a/arch/powerpc/oprofile/op_model_cell.c
+++ b/arch/powerpc/oprofile/op_model_cell.c
@@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n)
 		index = ENTRIES-1;
 
 	/* make sure index is valid */
-	if ((index > ENTRIES) || (index < 0))
+	if ((index >= ENTRIES) || (index < 0))
 		index = ENTRIES-1;
 
 	return initial_lfsr[index];

Re: [PATCH] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c

[Carl Love]

[-- Attachment #1.1: Type: text/plain, Size: 2614 bytes --]


Denis:

I have reviewed the change and agree to it.  Thanks for catching that.

          Carl Love



                                                                       
             Denis Kirjanov                                            
             <dkirjanov@hera.k                                         
             ernel.org>                                                 To
                                       arnd@arndb.de,                  
             06/01/2010 12:43          benh@kernel.crashing.org,       
             PM                        paulus@samba.org, jkosina@suse.cz
                                                                        cc
                                       linuxppc-dev@ozlabs.org,        
                                       oprofile-list@lists.sf.net      
                                                                   Subject
                                       [PATCH] powerpc/oprofile: fix   
                                       potential buffer overrun in     
                                       op_model_cell.c                 
                                                                       
                                                                       
                                                                       
                                                                       
                                                                       
                                                                       




Fix potential initial_lfsr buffer overrun.
Writing past the end of the buffer could happen when index == ENTRIES

Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org>
---
 arch/powerpc/oprofile/op_model_cell.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/powerpc/oprofile/op_model_cell.c
b/arch/powerpc/oprofile/op_model_cell.c
index 2c9e522..7fd90d0 100644
--- a/arch/powerpc/oprofile/op_model_cell.c
+++ b/arch/powerpc/oprofile/op_model_cell.c
@@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n)
 		 		 index = ENTRIES-1;

 		 /* make sure index is valid */
-		 if ((index > ENTRIES) || (index < 0))
+		 if ((index >= ENTRIES) || (index < 0))
 		 		 index = ENTRIES-1;

 		 return initial_lfsr[index];

------------------------------------------------------------------------------


_______________________________________________
oprofile-list mailing list
oprofile-list@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/oprofile-list

[-- Attachment #1.2: Type: text/html, Size: 3786 bytes --]

[-- Attachment #2: graycol.gif --]
[-- Type: image/gif, Size: 105 bytes --]

[-- Attachment #3: pic11538.gif --]
[-- Type: image/gif, Size: 1255 bytes --]

[-- Attachment #4: ecblank.gif --]
[-- Type: image/gif, Size: 45 bytes --]

Re: [PATCH] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c

[Robert Richter]

On 01.06.10 15:43:34, Denis Kirjanov wrote:
> Fix potential initial_lfsr buffer overrun.
> Writing past the end of the buffer could happen when index == ENTRIES
> 
> Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org>

Patch applied to

 git://git.kernel.org/pub/scm/linux/kernel/git/rric/oprofile.git urgent

Thanks Denis.

-Robert

-- 
Advanced Micro Devices, Inc.
Operating System Research Center
email: robert.richter@amd.com