Re: [PATCH 4.19 073/168] media: firewire: Using uninitialized values in node_probe()

Pavel Machek
2020-08-18T21:35:01Z

[-- Attachment #1: Type: text/plain, Size: 1392 bytes --]

Hi!

> From: Dan Carpenter <dan.carpenter@oracle.com>
>
> [ Upstream commit 2505a210fc126599013aec2be741df20aaacc490 ]
>
> If fw_csr_string() returns -ENOENT, then "name" is uninitialized. So
> then the "strlen(model_names[i]) <= name_len" is true because strlen()
> is unsigned and -ENOENT is type promoted to a very high positive value.
> Then the "strncmp(name, model_names[i], name_len)" uses uninitialized
> data because "name" is uninitialized.

This causes memory leak, AFAICT.

Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>

Best regards,
Pavel

diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
index eaf94b817dbc..2ac9d24d3f0c 100644
--- a/drivers/media/firewire/firedtv-fw.c
+++ b/drivers/media/firewire/firedtv-fw.c
@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)

name_len = fw_csr_string(unit->directory, CSR_MODEL,
name, sizeof(name));
- if (name_len < 0)
- return name_len;
+ if (name_len < 0) {
+ err = name_len;
+ goto fail_free;
+ }
for (i = ARRAY_SIZE(model_names); --i; )
if (strlen(model_names[i]) <= name_len &&
strncmp(name, model_names[i], name_len) == 0)

--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]