From mboxrd@z Thu Jan 1 00:00:00 1970 From: Anton Vorontsov Date: Sat, 05 May 2012 02:26:42 +0000 Subject: Re: [patch] max17042_battery: fix a couple buffer overflows Message-Id: <20120505022642.GA812@lizard> List-Id: References: <20120315113732.GA364@elgon.mountain> <4F6224E2.5060006@gmail.com> In-Reply-To: <4F6224E2.5060006@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Dirk Brandewie Cc: Dan Carpenter , Grant Likely , Rob Herring , MyungJoo Ham , Kyungmin Park , Philip Rakity , linux-kernel@vger.kernel.org, devicetree-discuss@lists.ozlabs.org, kernel-janitors@vger.kernel.org On Thu, Mar 15, 2012 at 10:20:34AM -0700, Dirk Brandewie wrote: > On 03/15/2012 04:37 AM, Dan Carpenter wrote: > >There are a couple issues here caused by confusion between sizeof() > >and ARRAY_SIZE(). "table_size" should be the number of elements, but we > >should allocate it with kcalloc() so that we allocate the correct number > >of bytes. > > > >In max17042_init_model() we don't allocate enough space so we go past > >the end of the array in max17042_read_model_data() and > >max17042_model_data_compare(). > > > >In max17042_verify_model_lock() we allocate the right amount of space > >but we call max17042_read_model_data() with the wrong number of elements > >and also in the for loop we go past the end of the array. > > > >Signed-off-by: Dan Carpenter > Acked-by: Dirk Brandewie > > Typo in first ack :-( Applied, thanks! :-) -- Anton Vorontsov Email: cbouatmailru@gmail.com