* [PATCH] Fix uninitialized access bug in utilfdt_decode_type
@ 2012-02-03 6:06 David Gibson
[not found] ` <1328249172-6282-1-git-send-email-david-xT8FGy+AXnRB3Ne2BGzF6laj5H9X9Tb+@public.gmane.org>
0 siblings, 1 reply; 2+ messages in thread
From: David Gibson @ 2012-02-03 6:06 UTC (permalink / raw)
To: jdl-CYoMK+44s/E; +Cc: devicetree-discuss-uLR06cmDAlY/bJ5BZ2RsiQ
I just found this little bug with valgrind. strchr() will return true
if the given character is '\0'. This meant that utilfdt_decode_type()
could take a path which accesses uninitialized data when given the
(invalid) format string "L".
Signed-off-by: David Gibson <david-xT8FGy+AXnRB3Ne2BGzF6laj5H9X9Tb+@public.gmane.org>
---
util.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/util.c b/util.c
index d82d41f..2422c34 100644
--- a/util.c
+++ b/util.c
@@ -296,6 +296,9 @@ int utilfdt_decode_type(const char *fmt, int *type, int *size)
{
int qualifier = 0;
+ if (!*fmt)
+ return -1;
+
/* get the conversion qualifier */
*size = -1;
if (strchr("hlLb", *fmt)) {
@@ -311,7 +314,7 @@ int utilfdt_decode_type(const char *fmt, int *type, int *size)
}
/* we should now have a type */
- if (!strchr("iuxs", *fmt))
+ if ((*fmt == '\0') || !strchr("iuxs", *fmt))
return -1;
/* convert qualifier (bhL) to byte size */
--
1.7.8.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Fix uninitialized access bug in utilfdt_decode_type
[not found] ` <1328249172-6282-1-git-send-email-david-xT8FGy+AXnRB3Ne2BGzF6laj5H9X9Tb+@public.gmane.org>
@ 2012-02-03 14:46 ` Jon Loeliger
0 siblings, 0 replies; 2+ messages in thread
From: Jon Loeliger @ 2012-02-03 14:46 UTC (permalink / raw)
To: David Gibson; +Cc: devicetree-discuss-uLR06cmDAlY/bJ5BZ2RsiQ
> I just found this little bug with valgrind. strchr() will return true
> if the given character is '\0'. This meant that utilfdt_decode_type()
> could take a path which accesses uninitialized data when given the
> (invalid) format string "L".
>
> Signed-off-by: David Gibson <david-xT8FGy+AXnRB3Ne2BGzF6laj5H9X9Tb+@public.gmane.org>
Applied.
Thanks,
jdl
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-02-03 14:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-03 6:06 [PATCH] Fix uninitialized access bug in utilfdt_decode_type David Gibson
[not found] ` <1328249172-6282-1-git-send-email-david-xT8FGy+AXnRB3Ne2BGzF6laj5H9X9Tb+@public.gmane.org>
2012-02-03 14:46 ` Jon Loeliger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox