From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Decotigny Subject: [ethtool PATCH v4 04/11] ethtool.c: do_seeprom checks for params & stdin sanity Date: Fri, 11 Mar 2016 09:58:17 -0800 Message-ID: <1457719104-39188-5-git-send-email-ddecotig@gmail.com> References: <1457719104-39188-1-git-send-email-ddecotig@gmail.com> Cc: Jeff Garzik , Ben Hutchings , David Miller , Vidya Sagar Ravipati , Joe Perches , David Decotigny To: netdev@vger.kernel.org Return-path: Received: from mail-pa0-f66.google.com ([209.85.220.66]:35521 "EHLO mail-pa0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750905AbcCKR6k (ORCPT ); Fri, 11 Mar 2016 12:58:40 -0500 Received: by mail-pa0-f66.google.com with SMTP id fl4so9043797pad.2 for ; Fri, 11 Mar 2016 09:58:39 -0800 (PST) In-Reply-To: <1457719104-39188-1-git-send-email-ddecotig@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: David Decotigny Tested: On qemu e1000: $ dd if=/dev/zero bs=2 count=5 | /mnt/ethtool -E eth0 length 9 too much data from stdin $ dd if=/dev/zero bs=2 count=5 | /mnt/ethtool -E eth0 length 11 not enough data from stdin $ dd if=/dev/zero bs=2 count=5 | /mnt/ethtool -E eth0 length 10 Cannot set EEPROM data: Bad address Signed-off-by: David Decotigny --- ethtool.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/ethtool.c b/ethtool.c index 7c2b5cb..d349bee 100644 --- a/ethtool.c +++ b/ethtool.c @@ -2828,8 +2828,10 @@ static int do_seeprom(struct cmd_context *ctx) if (seeprom_length == -1) seeprom_length = drvinfo.eedump_len; - if (drvinfo.eedump_len < seeprom_offset + seeprom_length) - seeprom_length = drvinfo.eedump_len - seeprom_offset; + if (drvinfo.eedump_len < seeprom_offset + seeprom_length) { + fprintf(stderr, "offset & length out of bounds\n"); + return 1; + } eeprom = calloc(1, sizeof(*eeprom)+seeprom_length); if (!eeprom) { @@ -2844,8 +2846,18 @@ static int do_seeprom(struct cmd_context *ctx) eeprom->data[0] = seeprom_value; /* Multi-byte write: read input from stdin */ - if (!seeprom_value_seen) - eeprom->len = fread(eeprom->data, 1, eeprom->len, stdin); + if (!seeprom_value_seen) { + if (1 != fread(eeprom->data, eeprom->len, 1, stdin)) { + fprintf(stderr, "not enough data from stdin\n"); + free(eeprom); + return 75; + } + if ((fgetc(stdin) != EOF) || !feof(stdin)) { + fprintf(stderr, "too much data from stdin\n"); + free(eeprom); + return 75; + } + } err = send_ioctl(ctx, eeprom); if (err < 0) { -- 2.7.0.rc3.207.g0ac5344