Messages in this thread | | | Date | Fri, 15 May 2015 20:04:47 +0200 | Subject | Re: [PATCH 1/4] ozwpan: Use proper check to prevent heap overflow | From | "Jason A. Donenfeld" <> |
| |
On May 15, 2015 4:10 PM, "David Laight" <David.Laight@aculab.com> wrote: > Why not just check the length. eg: > unsigned int data_len = elt->length; > if (data_len < sizeof(struct oz_get_desc_rsp) + 1) > break;
Sure.
> > u16 offs = le16_to_cpu(get_unaligned(&body->offset)); > > u16 total_size = > > le16_to_cpu(get_unaligned(&body->total_size)); > > Don't put variable definitions after code. > > You don't really want to do arithmetic on local variables that are > smaller than a machine word (eg u8 and u16), doing so can require > the compiler generate a lot more code.
This is code is just part of the patch context. Care to submit a follow up patch fixing this so the maintainer can incorporate it? FYI, this is a common occurrence throughout the driver, and a patch set should probably be posted that systematically fixes this problem.
| |