From: Jacob von Chorus <jacobvonchorus@cwphoto.ca>
To: Joe Perches <joe@perches.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Insop Song <insop.song@gainspeed.com>,
devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org,
dan.carpenter@oracle.com
Subject: Re: [PATCH v2 2/2] staging: gs_fpgaboot: change char to u8
Date: Mon, 17 Jul 2017 21:56:08 -0400 [thread overview]
Message-ID: <20170718015608.ehpguip72poza4ev@kerndev> (raw)
In-Reply-To: <1500340928.25934.18.camel@perches.com>
On Mon, Jul 17, 2017 at 06:22:08PM -0700, Joe Perches wrote:
> read_bitstream takes an int rdsize, not a u16.
> and this function will overflow tbuf if len > 64
>
> static void readinfo_bitstream(char *bitdata, char *buf, int *offset)
> {
> char tbuf[64];
> s32 len;
>
> /* read section char */
> read_bitstream(bitdata, tbuf, offset, 1);
>
> /* read length */
> read_bitstream(bitdata, tbuf, offset, 2);
>
> len = tbuf[0] << 8 | tbuf[1];
>
> read_bitstream(bitdata, buf, offset, len);
> buf[len] = '\0';
> }
>
> len is up to 64k but tbuf is 64 bytes.
tbuf is used here to read a total of 3 bytes over two calls to
read_bitstream. The larger read of size, len, is stored to buf which is
MAX_STR bytes in length.
> len = get_unaligned_le16(tbuf)
>
> might be nicer than
>
> len = tbuf[0] << 8 | tbuf[1];
Agreed, though it should be "get_unaligned_be16".
Thanks.
Regards,
Jacob von Chorus
next prev parent reply other threads:[~2017-07-18 1:56 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-18 0:47 [PATCH v2 1/2] staging: gs_fpgaboot: add buffer overflow checks Jacob von Chorus
2017-07-18 0:47 ` [PATCH v2 2/2] staging: gs_fpgaboot: change char to u8 Jacob von Chorus
2017-07-18 1:22 ` Joe Perches
2017-07-18 1:56 ` Jacob von Chorus [this message]
2017-07-18 7:00 ` [PATCH v2 1/2] staging: gs_fpgaboot: add buffer overflow checks Greg Kroah-Hartman
2017-07-18 9:15 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170718015608.ehpguip72poza4ev@kerndev \
--to=jacobvonchorus@cwphoto.ca \
--cc=dan.carpenter@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=insop.song@gainspeed.com \
--cc=joe@perches.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox