Skip to contentSkip to conversation

cifs: writing past the end of the array

PATCH In review Dan Carpenter 5 participants 7 messages Mar 6, 2011 – Mar 8, 2011 1 message not in the archive

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 cifs: writing past the end of the array

This is a cut and paste error. p16 only has 16 chars, not 21.

fs/cifs/smbencrypt.c +1 -1
index 3967635..1525d5e 100644
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 	int rc;
 	unsigned char p16[16], p21[21];
 
-	memset(p16, '\0', 21);
+	memset(p16, '\0', 16);
 	memset(p21, '\0', 21);
 
 	rc = E_md4hash(passwd, p16);
Reviewed-by on v1 1/1
#1 lore raw
Quoted 18 lines · Dan Carpenter

This is a cut and paste error.  p16 only has 16 chars, not 21.

fs/cifs/smbencrypt.c +1 -2
index 3967635..1525d5e 100644
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
        int rc;
        unsigned char p16[16], p21[21];
 
-       memset(p16, '\0', 21);
+       memset(p16, '\0', 16);
        memset(p21, '\0', 21);
 
        rc = E_md4hash(passwd, p16);
--
Quoted 4 lines

To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Looks correct.

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

#2 lore raw
In reply to Dan Carpenter

Am 06.03.2011 14:26, schrieb Dan Carpenter:

Quoted 9 lines

This is a cut and paste error. p16 only has 16 chars, not 21.

fs/cifs/smbencrypt.c +0 -0
index 3967635..1525d5e 100644

fs/cifs/smbencrypt.c SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24) · line 359

Quoted 8 lines
fs/cifs/smbencrypt.c +1 -1
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 	int rc;
 	unsigned char p16[16], p21[21];
 
-	memset(p16, '\0', 21);
+	memset(p16, '\0', 16);
 	memset(p21, '\0', 21);
 
 	rc = E_md4hash(passwd, p16);

perhaps ARRAY_SIZE() instead of a magic number is a better choice ?

re,
wh

A message that is not in the archive (sent off-list or not yet received): [email protected]

#4 lore raw
Quoted 15 lines · On Sun, 06 Mar 2011 18:11:23 +0100 walter harms <[email protected]> wrote:

Am 06.03.2011 14:26, schrieb Dan Carpenter:

Quoted 12 lines

This is a cut and paste error. p16 only has 16 chars, not 21.

fs/cifs/smbencrypt.c +0 -0
index 3967635..1525d5e 100644
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 	int rc;
 	unsigned char p16[16], p21[21];
 
Quoted 9 lines

fs/cifs/smbencrypt.c SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24) · line 359

Quoted 5 lines
fs/cifs/smbencrypt.c +1 -1
-	memset(p16, '\0', 21);
+	memset(p16, '\0', 16);
 	memset(p21, '\0', 21);
 
 	rc = E_md4hash(passwd, p16);

perhaps ARRAY_SIZE() instead of a magic number is a better choice ?

Agreed. Care to propose a patch? There are almost certainly other places in the code that could use a similar cleanup.

Signature · 1 line
Jeff Layton <[email protected]>
#5 lore raw
In reply to Dan Carpenter

merged. trivially correct.

Quoted 19 lines · Dan Carpenter

This is a cut and paste error. p16 only has 16 chars, not 21.

fs/cifs/smbencrypt.c +1 -1
index 3967635..1525d5e 100644
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
 unsigned char *p24)
       int rc;
       unsigned char p16[16], p21[21];
 
-       memset(p16, '\0', 21);
+       memset(p16, '\0', 16);
       memset(p21, '\0', 21);
 
       rc = E_md4hash(passwd, p16);
Signature · 3 lines
Thanks,

Steve
#6 lore raw
In reply to Dan Carpenter

Am 07.03.2011 17:09, schrieb Jeff Layton:

Quoted 22 lines
Quoted 19 lines · On Sun, 06 Mar 2011 18:11:23 +0100 walter harms <[email protected]> wrote:

Am 06.03.2011 14:26, schrieb Dan Carpenter:

Quoted 16 lines

This is a cut and paste error. p16 only has 16 chars, not 21.

fs/cifs/smbencrypt.c +1 -1
index 3967635..1525d5e 100644
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 	int rc;
 	unsigned char p16[16], p21[21];
 
-	memset(p16, '\0', 21);
+	memset(p16, '\0', 16);
 	memset(p21, '\0', 21);
 
Quoted 9 lines
Quoted 5 lines

fs/cifs/smbencrypt.c SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24) · line 359

Quoted 1 line
fs/cifs/smbencrypt.c +0 -0
 	rc = E_md4hash(passwd, p16);

perhaps ARRAY_SIZE() instead of a magic number is a better choice ?

Agreed. Care to propose a patch? There are almost certainly other places in the code that could use a similar cleanup.

Dan, i think he is sending to you :)

re,
wh

#7 lore raw
In reply to Dan Carpenter
Quoted 16 lines · walter harms
Quoted 16 lines
Quoted 15 lines

fs/cifs/smbencrypt.c SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24) · line 359

Quoted 11 lines
fs/cifs/smbencrypt.c +1 -1
@@ -353,7 +353,7 @@ SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 	int rc;
 	unsigned char p16[16], p21[21];
 
-	memset(p16, '\0', 21);
+	memset(p16, '\0', 16);
 	memset(p21, '\0', 21);
 
 	rc = E_md4hash(passwd, p16);

perhaps ARRAY_SIZE() instead of a magic number is a better choice ?

Quoted 6 lines
Quoted 3 lines

Agreed. Care to propose a patch? There are almost certainly other places in the code that could use a similar cleanup.

Dan, i think he is sending to you :)

Nah, man. He's talking to you. :P

The 16 can't change. It's built into the name. Also you should probably use sizeof() instead of ARRAY_SIZE(). They're the same in this case because it's type char but sizeof is more standard.

regards,
dan carpenter