* [patch] ipmr: off by one in __ipmr_fill_mroute()
@ 2010-05-22 17:54 Dan Carpenter
2010-05-26 7:39 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2010-05-22 17:54 UTC (permalink / raw)
To: netdev
Cc: Alexey Kuznetsov, Pekka Savola (ipv6), James Morris,
Hideaki YOSHIFUJI, Patrick McHardy, Eric Dumazet,
kernel-janitors@vger.kernel.org David S. Miller
This fixes a smatch warning:
net/ipv4/ipmr.c +1917 __ipmr_fill_mroute(12) error: buffer overflow
'(mrt)->vif_table' 32 <= 32
The ipv6 version had the same issue.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 4588910..856123f 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1911,7 +1911,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
struct rtattr *mp_head;
/* If cache is unresolved, don't try to parse IIF and OIF */
- if (c->mfc_parent > MAXVIFS)
+ if (c->mfc_parent >= MAXVIFS)
return -ENOENT;
if (VIF_EXISTS(mrt, c->mfc_parent))
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index bd9e7d3..073071f 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2017,7 +2017,7 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
struct rtattr *mp_head;
/* If cache is unresolved, don't try to parse IIF and OIF */
- if (c->mf6c_parent > MAXMIFS)
+ if (c->mf6c_parent >= MAXMIFS)
return -ENOENT;
if (MIF_EXISTS(mrt, c->mf6c_parent))
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] ipmr: off by one in __ipmr_fill_mroute()
2010-05-22 17:54 [patch] ipmr: off by one in __ipmr_fill_mroute() Dan Carpenter
@ 2010-05-26 7:39 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2010-05-26 7:39 UTC (permalink / raw)
To: error27; +Cc: netdev, kuznet, pekkas, jmorris, yoshfuji, kaber, eric.dumazet
From: Dan Carpenter <error27@gmail.com>
Date: Sat, 22 May 2010 19:54:48 +0200
> This fixes a smatch warning:
> net/ipv4/ipmr.c +1917 __ipmr_fill_mroute(12) error: buffer overflow
> '(mrt)->vif_table' 32 <= 32
>
> The ipv6 version had the same issue.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Introduced by commit "7438189b".
Applied, thanks Dan.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-05-26 7:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-22 17:54 [patch] ipmr: off by one in __ipmr_fill_mroute() Dan Carpenter
2010-05-26 7:39 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).