lkml.org 
[lkml]   [2023]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
On Tue, Dec 27, 2022 at 03:27:39PM +0100, Roberto Sassu wrote:
> From: Herbert Xu <herbert@gondor.apana.org.au>
>
> The helper mpi_read_raw_from_sgl sets the number of entries in
> the SG list according to nbytes. However, if the last entry
> in the SG list contains more data than nbytes, then it may overrun
> the buffer because it only allocates enough memory for nbytes.
>
> Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
> Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> ---
> lib/mpi/mpicoder.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)

Patch applied. Thanks.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

\
 
 \ /
  Last update: 2023-03-26 23:31    [W:0.308 / U:0.364 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site