public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Jacob von Chorus <jacobvonchorus@cwphoto.ca>
To: Joe Perches <joe@perches.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Insop Song <insop.song@gainspeed.com>,
	devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org,
	dan.carpenter@oracle.com
Subject: Re: [PATCH v2 2/2] staging: gs_fpgaboot: change char to u8
Date: Mon, 17 Jul 2017 21:56:08 -0400	[thread overview]
Message-ID: <20170718015608.ehpguip72poza4ev@kerndev> (raw)
In-Reply-To: <1500340928.25934.18.camel@perches.com>

On Mon, Jul 17, 2017 at 06:22:08PM -0700, Joe Perches wrote:
> read_bitstream takes an int rdsize, not a u16.
> and this function will overflow tbuf if len > 64
>
> static void readinfo_bitstream(char *bitdata, char *buf, int *offset)
> {
> 	char tbuf[64];
> 	s32 len;
> 
> 	/* read section char */
> 	read_bitstream(bitdata, tbuf, offset, 1);
> 
> 	/* read length */
> 	read_bitstream(bitdata, tbuf, offset, 2);
> 
> 	len = tbuf[0] << 8 | tbuf[1];
> 
> 	read_bitstream(bitdata, buf, offset, len);
> 	buf[len] = '\0';
> }
> 
> len is up to 64k but tbuf is 64 bytes.

tbuf is used here to read a total of 3 bytes over two calls to
read_bitstream. The larger read of size, len, is stored to buf which is
MAX_STR bytes in length. 

> 	len = get_unaligned_le16(tbuf)
> 
> might be nicer than
> 
> 	len = tbuf[0] << 8 | tbuf[1];

Agreed, though it should be "get_unaligned_be16". 

Thanks.

Regards,
Jacob von Chorus

  reply	other threads:[~2017-07-18  1:56 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-07-18  0:47 [PATCH v2 1/2] staging: gs_fpgaboot: add buffer overflow checks Jacob von Chorus
2017-07-18  0:47 ` [PATCH v2 2/2] staging: gs_fpgaboot: change char to u8 Jacob von Chorus
2017-07-18  1:22   ` Joe Perches
2017-07-18  1:56     ` Jacob von Chorus [this message]
2017-07-18  7:00 ` [PATCH v2 1/2] staging: gs_fpgaboot: add buffer overflow checks Greg Kroah-Hartman
2017-07-18  9:15 ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170718015608.ehpguip72poza4ev@kerndev \
    --to=jacobvonchorus@cwphoto.ca \
    --cc=dan.carpenter@oracle.com \
    --cc=devel@driverdev.osuosl.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=insop.song@gainspeed.com \
    --cc=joe@perches.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox