On Wed, Oct 28, 2015 at 10:26:27PM +0000, Xiao Guangrong wrote:
> +static void nvdimm_dsm_func_get_label_data(NVDIMMDevice *nvdimm,
> + nvdimm_dsm_in *in, GArray *out)
> +{
> + NVDIMMClass *nvc = NVDIMM_GET_CLASS(nvdimm);
> + nvdimm_func_in_get_label_data *get_label_data = &in->func_get_label_data;
> + void *buf;
> + uint32_t status = NVDIMM_DSM_STATUS_SUCCESS;
> +
> + le32_to_cpus(&get_label_data->offset);
> + le32_to_cpus(&get_label_data->length);
> +
> + nvdimm_debug("Read Label Data: offset %#x length %#x.\n",
> + get_label_data->offset, get_label_data->length);
> +
> + if (nvdimm->label_size < get_label_data->offset + get_label_data->length) {
Integer overflow isn't handled here and it's unclear if that can cause
problems later on. It's safest to catch it right away instead of
relying on nvc->read_label_data() to check again.
Attachment:
signature.asc
Description: PGP signature
