potential integer overflow in xenbus_file_write()

Dan Carpenter
2012-09-13T16:00:32Z

Hi,

I was reading some code and had a question in xenbus_file_write()

drivers/xen/xenbus/xenbus_dev_frontend.c
461 if ((len + u->len) > sizeof(u->u.buffer)) {
^^^^^^^^^^^^
Can this addition overflow? Should the test be something like:

if (len > sizeof(u->u.buffer) || len + u->len > sizeof(u->u.buffer)) {

462 /* On error, dump existing buffer */
463 u->len = 0;
464 rc = -EINVAL;
465 goto out;
466 }
467
468 ret = copy_from_user(u->u.buffer + u->len, ubuf, len);
469

regards,
dan carpenter