Messages in this thread | | | Date | Thu, 4 Jul 2019 21:50:25 +0200 | From | Pavel Machek <> | Subject | Re: [RFC PATCH] binfmt_elf: Extract .note.gnu.property from an ELF file |
| |
Hi!
> > +static int scan(u8 *buf, u32 buf_size, int item_size, test_item_fn test_item, > > + next_item_fn next_item, u32 *arg, u32 type, u32 *pos) > > +{ > > + int found = 0; > > + u8 *p, *max; > > + > > + max = buf + buf_size; > > + if (max < buf) > > + return 0; > > How can this ever legitimately happen? If it can't, perhaps you meant > to put a WARN_ON_ONCE() or something like that here? > Also, computing out-of-bounds pointers is UB (section 6.5.6 of C99: > "If both the pointer operand and the result point to elements of the > same array object, or one past the last element of the array object, > the evaluation shall not produce an overflow; otherwise, the behavior > is undefined."), and if the addition makes the pointer wrap, that's > certainly out of bounds; so I don't think this condition can trigger > without UB.
Kernel assumes sane compiler. We pass flags to get it... C99 does not quite apply here. Pavel
-- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [unhandled content-type:application/pgp-signature] | |