gpio-hammer: Avoid potential overflow in main
PATCH v3 1/1 gpio-hammer: Avoid potential overflow in main
If '-o' was used more than 64 times in a single invocation of gpio-hammer, this could lead to an overflow of the 'lines' array. This commit fixes this by avoiding the overflow and giving a proper diagnostic back to the user
Signed-off-by Gabriel Ravier <[email protected]>
--- tools/gpio/gpio-hammer.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
tools/gpio/gpio-hammer.c +16 -1
@@ -135,7 +135,14 @@ int main(int argc, char **argv) device_name = optarg;break ;case 'o' : - lines[i] =strtoul (optarg,NULL ,10 ); +/* +* Avoid overflow. Do not immediately error, we want to +* be able to accurately report on the amount of times +* '-o' was given to give an accurate error message +*/ +if (i <GPIOHANDLES_MAX ) + lines[i] =strtoul (optarg,NULL ,10 ); + i++;break ;case '?' :
@@ -143,6 +150,14 @@ int main(int argc, char **argv)return -1 ; } } + +if (i >=GPIOHANDLES_MAX ) { +fprintf (stderr, +"Only %d occurences of '-o' are allowed, %d were found\n" , +GPIOHANDLES_MAX , i +1 ); +return -1 ; + } + nlines = i;if (!device_name || !nlines) {
Signature · 1 line
2.24.1
czw., 12 mar 2020 o 15:50 Gabriel Ravier <[email protected]> napisał(a):
Quoted 47 lines
If '-o' was used more than 64 times in a single invocation of gpio-hammer, this could lead to an overflow of the 'lines' array. This commit fixes this by avoiding the overflow and giving a proper diagnostic back to the user
Signed-off-by Gabriel Ravier <[email protected]>--- tools/gpio/gpio-hammer.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)tools/gpio/gpio-hammer.c +16
-2@@ -135,7 +135,14 @@ int main(int argc, char **argv) device_name = optarg;break ;case 'o' : - lines[i] =strtoul (optarg,NULL ,10 ); +/* +* Avoid overflow. Do not immediately error, we want to +* be able to accurately report on the amount of times +* '-o' was given to give an accurate error message +*/ +if (i <GPIOHANDLES_MAX ) + lines[i] =strtoul (optarg,NULL ,10 ); + i++;break ;case '?' :@@ -143,6 +150,14 @@ int main(int argc, char **argv)return -1 ; } } + +if (i >=GPIOHANDLES_MAX ) { +fprintf (stderr, +"Only %d occurences of '-o' are allowed, %d were found\n" , +GPIOHANDLES_MAX , i +1 ); +return -1 ; + } + nlines = i;if (!device_name || !nlines) { --
Quoted 2 lines
2.24.1
Patch applied, thanks!
Bartosz