* [PATCH] dcssblk.c : Array index 'i' is used before limits check.
@ 2015-02-24 15:57 Ameen Ali
2015-02-24 16:29 ` Kees Cook
0 siblings, 1 reply; 5+ messages in thread
From: Ameen Ali @ 2015-02-24 15:57 UTC (permalink / raw)
To: schwidefsky, heiko.carstens, boaz, jack, axboe, keescook
Cc: linux-s390, linux-kernel, Ameen Ali
Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
---
drivers/s390/block/dcssblk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 96128cb..da21281 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
* parse input
*/
num_of_segments = 0;
- for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
+ for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
for (j = i; (buf[j] != ':') &&
(buf[j] != '\0') &&
(buf[j] != '\n') &&
--
2.1.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] dcssblk.c : Array index 'i' is used before limits check.
2015-02-24 15:57 Ameen Ali
@ 2015-02-24 16:29 ` Kees Cook
0 siblings, 0 replies; 5+ messages in thread
From: Kees Cook @ 2015-02-24 16:29 UTC (permalink / raw)
To: Ameen Ali
Cc: Martin Schwidefsky, Heiko Carstens, boaz, jack, Jens Axboe,
linux-s390, LKML
On Tue, Feb 24, 2015 at 7:57 AM, Ameen Ali <ameenali023@gmail.com> wrote:
> Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
Can you include some text in the commit message body explaining the
meaning of the change? (For example 'avoid out-of-bounds-read by
checking count before indexing' or something like that?)
Reviewed-by: Kees Cook <keescook@chromium.org>
Thanks!
-Kees
> ---
> drivers/s390/block/dcssblk.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
> index 96128cb..da21281 100644
> --- a/drivers/s390/block/dcssblk.c
> +++ b/drivers/s390/block/dcssblk.c
> @@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
> * parse input
> */
> num_of_segments = 0;
> - for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
> + for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
> for (j = i; (buf[j] != ':') &&
> (buf[j] != '\0') &&
> (buf[j] != '\n') &&
> --
> 2.1.0
>
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] dcssblk.c : Array index 'i' is used before limits check.
@ 2015-02-24 16:41 Ameen Ali
2015-02-24 16:44 ` Kees Cook
2015-02-25 9:26 ` Heiko Carstens
0 siblings, 2 replies; 5+ messages in thread
From: Ameen Ali @ 2015-02-24 16:41 UTC (permalink / raw)
To: schwidefsky, heiko.carstens, linux390, keescook, wsa
Cc: linux-s390, linux-kernel, Ameen Ali
avoid out-of-bounds-read by checking count before indexing.
Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
---
drivers/s390/block/dcssblk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 96128cb..da21281 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
* parse input
*/
num_of_segments = 0;
- for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
+ for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
for (j = i; (buf[j] != ':') &&
(buf[j] != '\0') &&
(buf[j] != '\n') &&
--
2.1.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] dcssblk.c : Array index 'i' is used before limits check.
2015-02-24 16:41 [PATCH] dcssblk.c : Array index 'i' is used before limits check Ameen Ali
@ 2015-02-24 16:44 ` Kees Cook
2015-02-25 9:26 ` Heiko Carstens
1 sibling, 0 replies; 5+ messages in thread
From: Kees Cook @ 2015-02-24 16:44 UTC (permalink / raw)
To: Ameen Ali
Cc: Martin Schwidefsky, Heiko Carstens, linux390, Wolfram Sang,
linux-s390, LKML
On Tue, Feb 24, 2015 at 8:41 AM, Ameen Ali <ameenali023@gmail.com> wrote:
> avoid out-of-bounds-read by checking count before indexing.
>
> Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
> ---
> drivers/s390/block/dcssblk.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
> index 96128cb..da21281 100644
> --- a/drivers/s390/block/dcssblk.c
> +++ b/drivers/s390/block/dcssblk.c
> @@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
> * parse input
> */
> num_of_segments = 0;
> - for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
> + for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
> for (j = i; (buf[j] != ':') &&
> (buf[j] != '\0') &&
> (buf[j] != '\n') &&
> --
> 2.1.0
>
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] dcssblk.c : Array index 'i' is used before limits check.
2015-02-24 16:41 [PATCH] dcssblk.c : Array index 'i' is used before limits check Ameen Ali
2015-02-24 16:44 ` Kees Cook
@ 2015-02-25 9:26 ` Heiko Carstens
1 sibling, 0 replies; 5+ messages in thread
From: Heiko Carstens @ 2015-02-25 9:26 UTC (permalink / raw)
To: Ameen Ali; +Cc: schwidefsky, linux390, keescook, wsa, linux-s390, linux-kernel
On Tue, Feb 24, 2015 at 06:41:50PM +0200, Ameen Ali wrote:
> avoid out-of-bounds-read by checking count before indexing.
>
> Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
> ---
> drivers/s390/block/dcssblk.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
> index 96128cb..da21281 100644
> --- a/drivers/s390/block/dcssblk.c
> +++ b/drivers/s390/block/dcssblk.c
> @@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
> * parse input
> */
> num_of_segments = 0;
> - for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
> + for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
Applied, thanks!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2015-02-25 9:26 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-02-24 16:41 [PATCH] dcssblk.c : Array index 'i' is used before limits check Ameen Ali
2015-02-24 16:44 ` Kees Cook
2015-02-25 9:26 ` Heiko Carstens
-- strict thread matches above, loose matches on Subject: below --
2015-02-24 15:57 Ameen Ali
2015-02-24 16:29 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox