From: Chen Gang <gang.chen@asianux.com>
To: David Miller <davem@davemloft.net>
Cc: sam@ravnborg.org, zhaohongjiang@huawei.com,
gregkh@linuxfoundation.org, sparclinux@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org
Subject: Re: [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
Date: Thu, 11 Jul 2013 07:41:22 +0800 [thread overview]
Message-ID: <51DDF122.9040206@asianux.com> (raw)
In-Reply-To: <20130710.134216.1407498845215548973.davem@davemloft.net>
On 07/11/2013 04:42 AM, David Miller wrote:
> From: Chen Gang <gang.chen@asianux.com>
> Date: Sat, 22 Jun 2013 13:26:09 +0800
>
>> >
>> > For the related next strcpy(), the destination length is less than 512,
>> > but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
>> > more than 512.
>> >
>> > One work flow may:
>> > openprom_sunos_ioctl() -> if (cmd == OPROMSETOPT)
>> > getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
>> > opromsetopt() -> devide the buffer into 'var' and 'value'
>> > of_set_property() -> pass
>> > prom_setprop() -> pass
>> > ldom_set_var()
>> >
>> > And do not mind the additional 4 alignment buffer increasing, since
>> > 'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
>> >
>> >
>> > Signed-off-by: Chen Gang <gang.chen@asianux.com>
> Applied.
>
>
Thank you for your work, especially you are very busy.
--
Chen Gang
prev parent reply other threads:[~2013-07-10 23:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-22 5:26 [PATCH] arch: sparc: kernel: check the memory length before use strcpy() Chen Gang
2013-07-10 20:42 ` David Miller
2013-07-10 23:41 ` Chen Gang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51DDF122.9040206@asianux.com \
--to=gang.chen@asianux.com \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sam@ravnborg.org \
--cc=sparclinux@vger.kernel.org \
--cc=zhaohongjiang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox