From: Julian Wiedmann
> Sent: 23 September 2020 09:37
>
> Indicate the max number of to-be-parsed characters, and avoid copying
> the address sub-string.
>
> Signed-off-by: Julian Wiedmann <jwi@xxxxxxxxxxxxx>
> ---
> drivers/s390/net/qeth_l3_sys.c | 27 ++++++++++++++-------------
> 1 file changed, 14 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
> index ca9c95b6bf35..05fa986e30fc 100644
> --- a/drivers/s390/net/qeth_l3_sys.c
> +++ b/drivers/s390/net/qeth_l3_sys.c
> @@ -409,21 +409,22 @@ static ssize_t qeth_l3_dev_ipato_add4_show(struct device *dev,
> static int qeth_l3_parse_ipatoe(const char *buf, enum qeth_prot_versions proto,
> u8 *addr, int *mask_bits)
> {
> - const char *start, *end;
> - char *tmp;
> - char buffer[40] = {0, };
> + const char *start;
> + char *sep, *tmp;
> + int rc;
>
> - start = buf;
> - /* get address string */
> - end = strchr(start, '/');
> - if (!end || (end - start >= 40)) {
> + /* Expected input pattern: %addr/%mask */
> + sep = strnchr(buf, 40, '/');
> + if (!sep)
> return -EINVAL;
> - }
> - strncpy(buffer, start, end - start);
> - if (qeth_l3_string_to_ipaddr(buffer, proto, addr)) {
> - return -EINVAL;
> - }
> - start = end + 1;
> +
> + /* Terminate the %addr sub-string, and parse it: */
> + *sep = '\0';
Is it valid to write into the input buffer here?
> + rc = qeth_l3_string_to_ipaddr(buf, proto, addr);
> + if (rc)
> + return rc;
> +
> + start = sep + 1;
> *mask_bits = simple_strtoul(start, &tmp, 10);
The use of strnchr() rather implies that the input
buffer may not be '\0' terminated.
If that is true then you've just run off the end of the
input buffer.
> if (!strlen(start) ||
> (tmp == start) ||
Hmmm... delete the strlen() clause.
It ought to test start[0], but the 'tmp == start' test
covers that case.
I don't understand why simple_strtoul() is deprecated.
I don't recall any of the replacements returning the
address of the terminating character.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
