Re: [PATCH 1/4] ozwpan: Use proper check to prevent heap overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On May 15, 2015 4:10 PM, "David Laight" <David.Laight@xxxxxxxxxx> wrote:
> Why not just check the length. eg:
>                         unsigned int data_len = elt->length;
>                         if (data_len < sizeof(struct oz_get_desc_rsp) + 1)
>                                 break;

Sure.

> >                       u16 offs = le16_to_cpu(get_unaligned(&body->offset));
> >                       u16 total_size =
> >                               le16_to_cpu(get_unaligned(&body->total_size));
>
> Don't put variable definitions after code.
>
> You don't really want to do arithmetic on local variables that are
> smaller than a machine word (eg u8 and u16), doing so can require
> the compiler generate a lot more code.

This is code is just part of the patch context. Care to submit a
follow up patch fixing this so the maintainer can incorporate it? FYI,
this is a common occurrence throughout the driver, and a patch set
should probably be posted that systematically fixes this problem.
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel




[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux