[RESEND PATCH v2] staging/wlan-ng: Fix potential buffer overflow in firmware handling

[RESEND PATCH v2] staging/wlan-ng: Fix potential buffer overflow in firmware handling

[Tillmann Heidsieck]

This patch fixes a potential buffer overflow detected by smatch.

pda16 has length 512, while processing an element with index < 512 we
are checking for an end marker in the next element. This poses a
potential buffer overflow if no end marker is present.

Signed-off-by: Tillmann Heidsieck <theidsieck@leenox.de>
---
v2: add missing Signed-off-by line


 drivers/staging/wlan-ng/prism2fw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/wlan-ng/prism2fw.c b/drivers/staging/wlan-ng/prism2fw.c
index fe36613..d357b7e 100644
--- a/drivers/staging/wlan-ng/prism2fw.c
+++ b/drivers/staging/wlan-ng/prism2fw.c
@@ -590,7 +590,7 @@ static int mkpdrlist(struct pda *pda)
 
 	pda->nrec = 0;
 	curroff = 0;
-	while (curroff < (HFA384x_PDA_LEN_MAX / 2) &&
+	while (curroff < (HFA384x_PDA_LEN_MAX / 2 - 1) &&
 	       le16_to_cpu(pda16[curroff + 1]) != HFA384x_PDR_END_OF_PDA) {
 		pda->rec[pda->nrec] = (hfa384x_pdrec_t *) &(pda16[curroff]);
 
@@ -626,7 +626,7 @@ static int mkpdrlist(struct pda *pda)
 		curroff += le16_to_cpu(pda16[curroff]) + 1;
 
 	}
-	if (curroff >= (HFA384x_PDA_LEN_MAX / 2)) {
+	if (curroff >= (HFA384x_PDA_LEN_MAX / 2 - 1)) {
 		pr_err("no end record found or invalid lengths in PDR data, exiting. %x %d\n",
 		       curroff, pda->nrec);
 		return 1;
-- 
2.6.0

Re: [RESEND PATCH v2] staging/wlan-ng: Fix potential buffer overflow in firmware handling

[Sudip Mukherjee]

On Sat, Oct 10, 2015 at 09:56:16PM +0200, Tillmann Heidsieck wrote:
> This patch fixes a potential buffer overflow detected by smatch.
> 
> pda16 has length 512, while processing an element with index < 512 we
> are checking for an end marker in the next element. This poses a
> potential buffer overflow if no end marker is present.
> 
> Signed-off-by: Tillmann Heidsieck <theidsieck@leenox.de>
> ---

Confused.
This you have already sent previously and has already been merged by
Greg.
4ccb726c728c ("staging: wlan-ng fix buffer overflow in firmware handling")

Signed-off-by: Tillmann Heidsieck <theidsieck@leenox.de>
Dated: Wed Sep 23

regards
sudip

Re: [RESEND PATCH v2] staging/wlan-ng: Fix potential buffer overflow in firmware handling

[Tillmann Heidsieck]

Oh sorry for the noise ... I officially suck and will try to better
myself. 

I must have rediscovered a problem I already fixed :-(

Again sorry for the noise
Tillmann

On Mon, Oct 12, 2015 at 04:32:17PM +0530, Sudip Mukherjee wrote:
> On Sat, Oct 10, 2015 at 09:56:16PM +0200, Tillmann Heidsieck wrote:
> > This patch fixes a potential buffer overflow detected by smatch.
> > 
> > pda16 has length 512, while processing an element with index < 512 we
> > are checking for an end marker in the next element. This poses a
> > potential buffer overflow if no end marker is present.
> > 
> > Signed-off-by: Tillmann Heidsieck <theidsieck@leenox.de>
> > ---
> 
> Confused.
> This you have already sent previously and has already been merged by
> Greg.
> 4ccb726c728c ("staging: wlan-ng fix buffer overflow in firmware handling")
> 
> Signed-off-by: Tillmann Heidsieck <theidsieck@leenox.de>
> Dated: Wed Sep 23
> 
> regards
> sudip

Re: [RESEND PATCH v2] staging/wlan-ng: Fix potential buffer overflow in firmware handling

[Sudip Mukherjee]

On Mon, Oct 12, 2015 at 01:35:54PM +0200, Tillmann Heidsieck wrote:
> 
> I must have rediscovered a problem I already fixed :-(

Which tree are you using? You should be using staging-testing branch of
the staging tree.

regards
sudip

Re: [RESEND PATCH v2] staging/wlan-ng: Fix potential buffer overflow in firmware handling

[Tillmann Heidsieck]

On Mon, Oct 12, 2015 at 05:11:08PM +0530, Sudip Mukherjee wrote:
> On Mon, Oct 12, 2015 at 01:35:54PM +0200, Tillmann Heidsieck wrote:
> > 
> > I must have rediscovered a problem I already fixed :-(
> 
> Which tree are you using? You should be using staging-testing branch of
> the staging tree.

Thanks for pointing this out. I was in fact using the wrong branch as a
base. Can you point me in the direction of some sort of best-practice or
example work-flow on how to work with all the different trees and
branches? I always like to see how different people do things in order
to combine them and find what suits me best. 

> 
> regards
> sudip

regards
Tillmann