Re: [patch -RESEND] NFC: potential overflows in microread_target_discovered()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Sep 2, 2014 at 10:54 AM, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> On Tue, Sep 02, 2014 at 09:02:36AM +0200, Frans Klaver wrote:
>> > diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c
>> > index f868333271aa..963a4a5dc88e 100644
>> > --- a/drivers/nfc/microread/microread.c
>> > +++ b/drivers/nfc/microread/microread.c
>> > @@ -501,9 +501,13 @@ static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate,
>> >                 targets->sens_res =
>> >                          be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA]);
>> >                 targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK];
>> > -               memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID],
>> > -                      skb->data[MICROREAD_EMCF_A_LEN]);
>> >                 targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN];
>> > +               if (targets->nfcid1_len > sizeof(targets->nfcid1)) {
>>
>> You should probably compare against sizeof(*targets->nfcid1).
>>
>
> No.  It's an array not a pointer.

Ai, I overlooked that one. My bad.
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux