From: Chris Brannon <chris@the-brannons.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Raphael S Carvalho <raphael.scarv@gmail.com>,
devel@driverdev.osuosl.org, Kirk Reiser <kirk@reisers.ca>,
speakup@braille.uwo.ca,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org,
Samuel Thibault <samuel.thibault@ens-lyon.org>,
Andrew Morton <akpm@linux-foundation.org>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Subject: Re: [PATCH 1/1] staging/speakup/kobjects.c: Code improvement.
Date: Tue, 10 Sep 2013 18:29:39 -0700 [thread overview]
Message-ID: <878uz4du2k.fsf@mushroom.PK5001Z> (raw)
In-Reply-To: <20130910231228.GF6329@mwanda> (Dan Carpenter's message of "Wed, 11 Sep 2013 02:12:29 +0300")
Dan Carpenter <dan.carpenter@oracle.com> writes:
> Good eye for spotting the memory corruption bug!
>
> This is a bug fix, so the fix should go in a separate patch and not
> merged with a code cleanup patch. Ordinary users can trigger this so
> it's a security bug and separating it out is extra important.
Ok. I just sent up a patch to the driverdev list. I missed a few
of the Cc's that were on this thread, though.
Also, it will conflict with Raphael's cleanup.
> The checking in spk_set_num_var() is not sufficient as well. If we use
> E_INC then we can hit an integer overflow bug:
Good catch. In fact, we shouldn't be using input at all! Instead, we
need to use the value of the voice parameter after it was changed. That
will be a valid index into the two tables. My patch does so.
-- Chris
next prev parent reply other threads:[~2013-09-11 1:29 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-02 22:20 [PATCH 1/1] staging/speakup/kobjects.c: Code improvement Raphael S.Carvalho
2013-09-09 3:56 ` Chris Brannon
[not found] ` <CACz=WeeE+jxdaxpR_amF60deDcEy8nChYYfY3UA3CNfhmOB8Gw@mail.gmail.com>
2013-09-09 4:16 ` Fwd: " Raphael S Carvalho
2013-09-09 6:02 ` Chris Brannon
2013-09-10 23:12 ` Dan Carpenter
2013-09-11 1:29 ` Chris Brannon [this message]
2013-09-11 7:59 ` Dan Carpenter
2013-09-11 21:01 ` Samuel Thibault
-- strict thread matches above, loose matches on Subject: below --
2013-06-22 1:54 Raphael S. Carvalho
2013-06-30 8:11 ` Samuel Thibault
2013-07-23 21:39 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878uz4du2k.fsf@mushroom.PK5001Z \
--to=chris@the-brannons.com \
--cc=akpm@linux-foundation.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=dan.carpenter@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=kirk@reisers.ca \
--cc=linux-kernel@vger.kernel.org \
--cc=raphael.scarv@gmail.com \
--cc=samuel.thibault@ens-lyon.org \
--cc=speakup@braille.uwo.ca \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.