* [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
@ 2013-05-30 3:35 Chen Gang
2013-06-19 9:13 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Chen Gang @ 2013-05-30 3:35 UTC (permalink / raw)
To: David Miller, linux-kernel@vger.kernel.org, Linux-Arch,
Sam Ravnborg
Cc: sparclinux
When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
repeating which may cause memory overflow.
So need additional length check for it in the outside looping.
Also beautify the related code which found by "./scripts/checkpatch.pl"
Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
arch/sparc/prom/bootstr_32.c | 12 +++++++-----
1 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c
index f5ec32e..d2b49d2 100644
--- a/arch/sparc/prom/bootstr_32.c
+++ b/arch/sparc/prom/bootstr_32.c
@@ -23,23 +23,25 @@ prom_getbootargs(void)
return barg_buf;
}
- switch(prom_vers) {
+ switch (prom_vers) {
case PROM_V0:
cp = barg_buf;
/* Start from 1 and go over fd(0,0,0)kernel */
- for(iter = 1; iter < 8; iter++) {
+ for (iter = 1; iter < 8; iter++) {
arg = (*(romvec->pv_v0bootargs))->argv[iter];
if (arg == NULL)
break;
- while(*arg != 0) {
+ while (*arg != 0) {
/* Leave place for space and null. */
- if(cp >= barg_buf + BARG_LEN-2){
+ if (cp >= barg_buf + BARG_LEN - 2)
/* We might issue a warning here. */
break;
- }
*cp++ = *arg++;
}
*cp++ = ' ';
+ if (cp >= barg_buf + BARG_LEN - 1)
+ /* We might issue a warning here. */
+ break;
}
*cp = 0;
break;
--
1.7.7.6
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
2013-05-30 3:35 [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping Chen Gang
@ 2013-06-19 9:13 ` David Miller
2013-06-19 9:24 ` Chen Gang
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2013-06-19 9:13 UTC (permalink / raw)
To: gang.chen; +Cc: linux-kernel, linux-arch, sam, sparclinux
From: Chen Gang <gang.chen@asianux.com>
Date: Thu, 30 May 2013 11:35:22 +0800
>
> When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
> but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
> repeating which may cause memory overflow.
>
> So need additional length check for it in the outside looping.
>
> Also beautify the related code which found by "./scripts/checkpatch.pl"
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
2013-06-19 9:13 ` David Miller
@ 2013-06-19 9:24 ` Chen Gang
0 siblings, 0 replies; 3+ messages in thread
From: Chen Gang @ 2013-06-19 9:24 UTC (permalink / raw)
To: David Miller; +Cc: linux-kernel, linux-arch, sam, sparclinux
On 06/19/2013 05:13 PM, David Miller wrote:
> From: Chen Gang <gang.chen@asianux.com>
> Date: Thu, 30 May 2013 11:35:22 +0800
>
>>
>> When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
>> but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
>> repeating which may cause memory overflow.
>>
>> So need additional length check for it in the outside looping.
>>
>> Also beautify the related code which found by "./scripts/checkpatch.pl"
>
> Applied.
>
>
Thank you very much.
--
Chen Gang
Asianux Corporation
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-06-19 9:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-30 3:35 [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping Chen Gang
2013-06-19 9:13 ` David Miller
2013-06-19 9:24 ` Chen Gang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox