Hi Dan,
Am 17.01.2013 08:44, schrieb Dan Carpenter:
> If l == 12 then later we subtract 12 leaving zero. We do a zero size
> allocation, so "dbgline" points to the ZERO_SIZE_PTR. It leads to an
> oops when we set the NUL terminator:
> dbgline[3 * l - 1] = '\0';
thanks for finding that bug, but NAK to your fix.
> @@ -239,7 +239,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
> return;
>
> l = CAPIMSG_LEN(data);
> - if (l < 12) {
> + if (l <= 12) {
> gig_dbg(level, "%s: ??? LEN=%04d", tag, l);
> return;
> }
CAPI messages of exactly 12 bytes are legal, and should be decoded
with the regular gig_dbg() call immediately after that hunk. It's
just the hex dump part that should be skipped in that case.
So I'd prefer to have it fixed this way instead:
@@ -248,6 +248,8 @@ static inline void dump_rawmsg(enum debuglevel
level, const char *tag,
CAPIMSG_APPID(data), CAPIMSG_MSGID(data), l,
CAPIMSG_CONTROL(data));
l -= 12;
+ if (l <= 0)
+ return;
dbgline = kmalloc(3 * l, GFP_ATOMIC);
if (!dbgline)
return;
I'll prepare a patch of my own, citing you as reporter, if that's
ok with you.
Thanks,
Tilman
--
Tilman Schmidt E-Mail: tilman@xxxxxxx
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)
Attachment:
signature.asc
Description: OpenPGP digital signature
