Re: [patch] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Sep 15, 2016 at 03:19:12PM +0200, Tomas Henzl wrote:
> > @@ -2397,6 +2398,10 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
> >  		}
> >  		ptmpuserbuffer = ver_addr;
> >  		user_len = pcmdmessagefld->cmdmessage.Length;
> > +		if (user_len > ARCMSR_API_DATA_BUFLEN) {
> > +			retvalue = ARCMSR_MESSAGE_FAIL;
> 
> Hi,
> I think that a 'kfree(ver_addr);' should be added here.
> With that you may add my reviewed-by.

Oops...  Thanks for catching that.  I should have been more careful.

v2 on the way.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux