Search Linux Wireless

Re: [patch -RESEND] NFC: potential overflows in microread_target_discovered()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Sep 02, 2014 at 09:02:36AM +0200, Frans Klaver wrote:
> > diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c
> > index f868333271aa..963a4a5dc88e 100644
> > --- a/drivers/nfc/microread/microread.c
> > +++ b/drivers/nfc/microread/microread.c
> > @@ -501,9 +501,13 @@ static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate,
> >                 targets->sens_res =
> >                          be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA]);
> >                 targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK];
> > -               memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID],
> > -                      skb->data[MICROREAD_EMCF_A_LEN]);
> >                 targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN];
> > +               if (targets->nfcid1_len > sizeof(targets->nfcid1)) {
> 
> You should probably compare against sizeof(*targets->nfcid1).
> 

No.  It's an array not a pointer.

You should make a small test program to test your ideas.

int main(void)
{
        char buf[10];

        printf("%d %d\n", sizeof(buf), sizeof(*buf));
        return 0;
}

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux