Linux wireless drivers development
 help / color / mirror / Atom feed
* re: NFC: Set local general bytes in nci_start_poll
@ 2012-09-26 14:05 Dan Carpenter
  2012-10-09 12:26 ` Elias, Ilan
  0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2012-09-26 14:05 UTC (permalink / raw)
  To: ilane; +Cc: linux-nfc, linux-wireless

Hello Ilan Elias,

The patch 7e0352306f68: "NFC: Set local general bytes in 
nci_start_poll" from Aug 15, 2012, leads to the following warning:
net/nfc/nci/core.c:427 nci_set_local_general_bytes()
	 error: buffer overflow 'local_gb' 48 <= 250

   416          __u8 local_gb[NFC_MAX_GT_LEN];
                              ^^^^^^^^^^^^^^
48 elements.

   417          int i, rc = 0;
   418  
   419          param.val = nfc_get_local_general_bytes(nfc_dev, &param.len);
   420          if ((param.val == NULL) || (param.len == 0))
   421                  return rc;
   422  
   423          if (param.len > NCI_MAX_PARAM_LEN)
                                ^^^^^^^^^^^^^^^^^
Capped at 250.  Probably NFC_MAX_GT_LEN was intended?

   424                  return -EINVAL;
   425  
   426          for (i = 0; i < param.len; i++)
   427                  local_gb[param.len-1-i] = param.val[i];
                                 ^^^^^^^^^^^^^
Writing to the 250th element.

This is just a sanity check and nfc_get_local_general_bytes() will only
return NFC_MAX_GT_LEN max because of the check in nfc_llcp_build_gb().

regards,
dan carpenter


^ permalink raw reply	[flat|nested] 2+ messages in thread
* RE: NFC: Set local general bytes in nci_start_poll
  2012-09-26 14:05 NFC: Set local general bytes in nci_start_poll Dan Carpenter
@ 2012-10-09 12:26 ` Elias, Ilan
  0 siblings, 0 replies; 2+ messages in thread
From: Elias, Ilan @ 2012-10-09 12:26 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: linux-nfc@lists.01.org, linux-wireless@vger.kernel.org,
	Szymon Janc

Hi Dan,

Sorry for the late response, I was on vacation. 

> Hello Ilan Elias,
> 
> The patch 7e0352306f68: "NFC: Set local general bytes in 
> nci_start_poll" from Aug 15, 2012, leads to the following warning:
> net/nfc/nci/core.c:427 nci_set_local_general_bytes()
> 	 error: buffer overflow 'local_gb' 48 <= 250
> 
>    416          __u8 local_gb[NFC_MAX_GT_LEN];
>                               ^^^^^^^^^^^^^^
> 48 elements.
> 
>    417          int i, rc = 0;
>    418  
>    419          param.val = 
> nfc_get_local_general_bytes(nfc_dev, &param.len);
>    420          if ((param.val == NULL) || (param.len == 0))
>    421                  return rc;
>    422  
>    423          if (param.len > NCI_MAX_PARAM_LEN)
>                                 ^^^^^^^^^^^^^^^^^
> Capped at 250.  Probably NFC_MAX_GT_LEN was intended?
> 
>    424                  return -EINVAL;
>    425  
>    426          for (i = 0; i < param.len; i++)
>    427                  local_gb[param.len-1-i] = param.val[i];
>                                  ^^^^^^^^^^^^^
> Writing to the 250th element.
> 
> This is just a sanity check and nfc_get_local_general_bytes() 
> will only
> return NFC_MAX_GT_LEN max because of the check in nfc_llcp_build_gb().

You're right.
I see now that Szymon Janc already sent a patch for this a few days ago.

Thanks & BR,
Ilan


^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-10-09 12:26 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-26 14:05 NFC: Set local general bytes in nci_start_poll Dan Carpenter
2012-10-09 12:26 ` Elias, Ilan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox