lkml.org 
[lkml]   [2015]   [May]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/4] ozwpan: Use proper check to prevent heap overflow
From
On May 15, 2015 4:10 PM, "David Laight" <David.Laight@aculab.com> wrote:
> Why not just check the length. eg:
> unsigned int data_len = elt->length;
> if (data_len < sizeof(struct oz_get_desc_rsp) + 1)
> break;

Sure.

> > u16 offs = le16_to_cpu(get_unaligned(&body->offset));
> > u16 total_size =
> > le16_to_cpu(get_unaligned(&body->total_size));
>
> Don't put variable definitions after code.
>
> You don't really want to do arithmetic on local variables that are
> smaller than a machine word (eg u8 and u16), doing so can require
> the compiler generate a lot more code.

This is code is just part of the patch context. Care to submit a
follow up patch fixing this so the maintainer can incorporate it? FYI,
this is a common occurrence throughout the driver, and a patch set
should probably be posted that systematically fixes this problem.


\
 
 \ /
  Last update: 2015-05-15 20:21    [W:0.068 / U:1.152 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site