From: Kees Cook <keescook@chromium.org>
To: Julius Werner <jwerner@chromium.org>
Cc: Jack Rosenthal <jrosenth@chromium.org>,
Paul Menzel <pmenzel@molgen.mpg.de>,
Guenter Roeck <groeck@chromium.org>,
Brian Norris <briannorris@chromium.org>,
Stephen Boyd <swboyd@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH v2] firmware: coreboot: Check size of table entry and split memcpy
Date: Thu, 12 Jan 2023 15:00:38 -0800 [thread overview]
Message-ID: <202301121458.865E4834C@keescook> (raw)
In-Reply-To: <CAODwPW9SaomZjWQvR1mmV7OzvQkq-_XoDgSmK04fO5rVMGHmpw@mail.gmail.com>
On Mon, Jan 09, 2023 at 04:02:26PM +0100, Julius Werner wrote:
> Reviewed-by: Julius Werner <jwerner@chromium.org>
>
> > - memcpy(&device->entry, ptr_entry, entry->size);
> > + memcpy(device->raw, entry, entry->size);
>
> nit: It's a bit odd to change the source pointer from ptr_entry to
> entry here. Technically the static analyzer would be within its rights
> to give you a warning for that as well, because you're now
> "overrunning" the source struct instead of the destination one.
True. We've been focused on write overflows, but yeah, since the
location of the flex array changed, I'll switch this back to ptr_entry.
--
Kees Cook
prev parent reply other threads:[~2023-01-12 23:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-07 3:14 [PATCH v2] firmware: coreboot: Check size of table entry and split memcpy Kees Cook
2023-01-07 4:39 ` Guenter Roeck
2023-01-09 15:02 ` Julius Werner
2023-01-12 23:00 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202301121458.865E4834C@keescook \
--to=keescook@chromium.org \
--cc=briannorris@chromium.org \
--cc=gregkh@linuxfoundation.org \
--cc=groeck@chromium.org \
--cc=jrosenth@chromium.org \
--cc=jwerner@chromium.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pmenzel@molgen.mpg.de \
--cc=swboyd@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox