Re: [PATCH v2 1/7] Fix invalid memory access when EIR field length is zero

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Luiz,

On Thu, Nov 11, 2010, Luiz Augusto von Dentz wrote:
> >        while (len < EIR_DATA_LENGTH - 1) {
> > -               uint8_t type = eir_data[1];
> >                uint8_t field_len = eir_data[0];
> >
> >                /* Check for the end of EIR */
> >                if (field_len == 0)
> >                        break;
> >
> > -               switch (type) {
> > +               switch (eir_data[1]) {
> >                case EIR_UUID16_SOME:
> >                case EIR_UUID16_ALL:
> >                        uuid16_count = field_len / 2;
> 
> IMO type is easier to understand here, we just need to initialize it
> latter after the length check.

True, however I wasn't bothered enough about this and went ahead and
pushed the patch anyway upstream. If someone feels like it, feel free to
reintroduce the variable ;)

Johan
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux