gpio-hammer: Avoid potential overflow in main
PATCH v2 1/1 gpio-hammer: Avoid potential overflow in main
If '-o' was used more than 64 times in a single invocation of gpio-hammer, this could lead to an overflow of the 'lines' array. This commit fixes this by avoiding the overflow and giving a proper diagnostic back to the user
--- tools/gpio/gpio-hammer.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
tools/gpio/gpio-hammer.c +16 -1
@@ -135,7 +135,14 @@ int main(int argc, char **argv) device_name = optarg;break ;case 'o' : - lines[i] =strtoul (optarg,NULL ,10 ); +/* +* Avoid overflow. Do not immediately error, we want to +* be able to accurately report on the amount of times +*'-o' was given to give an accurate error message +*/ +if (i <GPIOHANDLES_MAX ) + lines[i] =strtoul (optarg,NULL ,10 ); + i++;break ;case '?' :
@@ -143,6 +150,14 @@ int main(int argc, char **argv)return -1 ; } } + +if (i >=GPIOHANDLES_MAX ) { +fprintf (stderr, +"Only %d occurences of '-o' are allowed, %d were found\n" , +GPIOHANDLES_MAX , i +1 ); +return -1 ; + } + nlines = i;if (!device_name || !nlines) {
Signature · 1 line
2.24.1
Quoted 35 lines · Gabriel Ravier
If '-o' was used more than 64 times in a single invocation of gpio-hammer, this could lead to an overflow of the 'lines' array. This commit fixes this by avoiding the overflow and giving a proper diagnostic back to the user
Signed-off-by Gabriel Ravier <[email protected]>--- tools/gpio/gpio-hammer.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)tools/gpio/gpio-hammer.c +9
-1@@ -135,7 +135,14 @@ int main(int argc, char **argv) device_name = optarg;break ;case 'o' : - lines[i] =strtoul (optarg,NULL ,10 ); +/* +* Avoid overflow. Do not immediately error, we want to +* be able to accurately report on the amount of times +*'-o' was given to give an accurate error message +*/ +if (i <GPIOHANDLES_MAX ) + lines[i] =strtoul (optarg,NULL ,10 ); + i++;break ;case '?' :@@ -143,6 +150,14 @@ int main(int argc, char **argv)return -1 ; } } +
tools/gpio/gpio-hammer.c int main(int argc, char **argv) · line 163
Quoted 10 lines
tools/gpio/gpio-hammer.c +7
-0+if (i >=GPIOHANDLES_MAX ) { +fprintf (stderr, +"Only %d occurences of '-o' are allowed, %d were found\n" , +GPIOHANDLES_MAX , i +1 ); +return -1 ; + } + nlines = i;if (!device_name || !nlines) {
Just noticed that there isn't a space before the "'-o'" in the third line of the explanatory comment in the first part of the patch, will send a third version of the patch with a space before the "'-o'"