Re: [PATCH 2/2 v2] staging: vt6656: integer overflows in private_ioctl()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Nov 30, 2011, at 10:15 AM, Dan Carpenter wrote:
> It doesn't actually matter because sizeof(SBSSIDList) is just 4 but
> normally you would do the math different.
> 
> 		if (sList.uItem > ULONG_MAX / sizeof(SBSSIDItem) - sizeof(SBSSIDList)) {
> 
> But both checks are low enough in this case.

Just out of curiosity, why do you prefer this form here?

In general, for *alloc(a + x * b), the check

	x > (umax - a) / b

looks more correct to me.

- xi
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel


[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux