* [PATCH] MIPS: Read buffer overflow
@ 2009-07-29 20:02 Roel Kluin
2009-07-29 21:25 ` Ralf Baechle
0 siblings, 1 reply; 4+ messages in thread
From: Roel Kluin @ 2009-07-29 20:02 UTC (permalink / raw)
To: ralf, linux-mips, Andrew Morton
it should tests against ARRAY_SIZE(psp_var_map) instead of sizeof(psp_var_map)
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
ARRAY_SIZE(psp_var_map) is 9.
sizeof(psp_var_map) is 144.
diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c
index a320bce..5ad6f1d 100644
--- a/arch/mips/ar7/prom.c
+++ b/arch/mips/ar7/prom.c
@@ -144,7 +144,7 @@ static char * __init lookup_psp_var_map(u8 num)
{
int i;
- for (i = 0; i < sizeof(psp_var_map); i++)
+ for (i = 0; i < ARRAY_SIZE(psp_var_map); i++)
if (psp_var_map[i].num == num)
return psp_var_map[i].value;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] MIPS: Read buffer overflow
2009-07-29 20:02 [PATCH] MIPS: Read buffer overflow Roel Kluin
@ 2009-07-29 21:25 ` Ralf Baechle
0 siblings, 0 replies; 4+ messages in thread
From: Ralf Baechle @ 2009-07-29 21:25 UTC (permalink / raw)
To: Roel Kluin; +Cc: linux-mips, Andrew Morton
On Wed, Jul 29, 2009 at 10:02:53PM +0200, Roel Kluin wrote:
> it should tests against ARRAY_SIZE(psp_var_map) instead of sizeof(psp_var_map)
Thanks, applied.
Ralf
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] MIPS: Read buffer overflow
@ 2009-07-31 12:52 Roel Kluin
2009-08-02 22:46 ` Ralf Baechle
0 siblings, 1 reply; 4+ messages in thread
From: Roel Kluin @ 2009-07-31 12:52 UTC (permalink / raw)
To: ralf, linux-mips, Andrew Morton
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
index f0fd636..0d64d0f 100644
--- a/arch/mips/jazz/jazzdma.c
+++ b/arch/mips/jazz/jazzdma.c
@@ -190,7 +190,7 @@ int vdma_free(unsigned long laddr)
return -1;
}
- while (pgtbl[i].owner == laddr && i < VDMA_PGTBL_ENTRIES) {
+ while (i < VDMA_PGTBL_ENTRIES && pgtbl[i].owner == laddr) {
pgtbl[i].owner = VDMA_PAGE_EMPTY;
i++;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] MIPS: Read buffer overflow
2009-07-31 12:52 Roel Kluin
@ 2009-08-02 22:46 ` Ralf Baechle
0 siblings, 0 replies; 4+ messages in thread
From: Ralf Baechle @ 2009-08-02 22:46 UTC (permalink / raw)
To: Roel Kluin; +Cc: linux-mips, Andrew Morton
On Fri, Jul 31, 2009 at 02:52:51PM +0200, Roel Kluin wrote:
Thanks, applied!
Ralf
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-08-02 22:47 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-29 20:02 [PATCH] MIPS: Read buffer overflow Roel Kluin
2009-07-29 21:25 ` Ralf Baechle
-- strict thread matches above, loose matches on Subject: below --
2009-07-31 12:52 Roel Kluin
2009-08-02 22:46 ` Ralf Baechle
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).