Messages in this thread | | | From | Hayes Wang <> | Subject | RE: [PATCH net-next 4/4] r8152: support firmware files | Date | Wed, 20 Aug 2014 12:35:09 +0000 |
| |
Daniele Forsi [mailto:dforsi@gmail.com] > Sent: Wednesday, August 20, 2014 8:01 PM > To: Hayes Wang > Cc: netdev@vger.kernel.org; nic_swsd; > linux-kernel@vger.kernel.org; USB list > Subject: Re: [PATCH net-next 4/4] r8152: support firmware files [...] > > + start = le32_to_cpu(fw_header->fw_start); > > + if (start > fw->size) > > + goto out; > > since "start" is an offset in an array of size "fw->size" this should > check for ">=" and if a command is at least cmd(2 bytes) + length(2 > bytes), shouldn't this check for "start >= fw->size - 4"?
Is this necessary? Besides the check of the "start", there are checks of the "size" and rtl_fw_data_ok(). I think they cover the situations which you indicate.
Best Regards, Hayes
| |