Re: [PATCH] Fix NR_KEYS off-by-one error

[OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>]

Vojtech Pavlik <vojtech@suse.cz> writes:

> On Wed, Jul 28, 2004 at 01:37:00AM +0900, OGAWA Hirofumi wrote:
> 
> > Vojtech Pavlik <vojtech@suse.cz> writes:
> > 
> > > > This all seems a bit inconclusive.  Do we proceed with the original patch
> > > > or not?  If not, how do we fix the overflow which Hirofumi has identified?
> > > 
> > > I think we should check the value in the ioctl, regardless of what's
> > > NR_KEYS defined to.
> > 
> > However, it breaks the current binary instead. (at least
> > console-tools, kbdutils).
>  
> We can do both, then, if that helps.

I'm confused. Sorry.

What is meaning of both? The following patch?  If so, "if (i >= NR_KEYS)"
part is never true, because "i" is unsigned char.
-- 
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

diff -puN include/linux/keyboard.h~nr_keys-off-by-one include/linux/keyboard.h
--- linux-2.6.8-rc2/include/linux/keyboard.h~nr_keys-off-by-one	2004-07-26 00:26:59.000000000 +0900
+++ linux-2.6.8-rc2-hirofumi/include/linux/keyboard.h	2004-07-26 00:26:59.000000000 +0900
@@ -16,7 +16,7 @@
 
 #define NR_SHIFT	9
 
-#define NR_KEYS		255
+#define NR_KEYS		256
 #define MAX_NR_KEYMAPS	256
 /* This means 128Kb if all keymaps are allocated. Only the superuser
 	may increase the number of keymaps beyond MAX_NR_OF_USER_KEYMAPS. */
diff -puN drivers/char/vt_ioctl.c~nr_keys-off-by-one drivers/char/vt_ioctl.c
--- linux-2.6.8-rc2/drivers/char/vt_ioctl.c~nr_keys-off-by-one	2004-07-28 03:18:43.000000000 +0900
+++ linux-2.6.8-rc2-hirofumi/drivers/char/vt_ioctl.c	2004-07-28 03:22:24.000000000 +0900
@@ -82,6 +82,8 @@ do_kdsk_ioctl(int cmd, struct kbentry __
 
 	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
 		return -EFAULT;
+	if (i >= NR_KEYS)
+		return -EINVAL;
 
 	switch (cmd) {
 	case KDGKBENT:
_