Skip to contentSkip to conversation

powerpc: Read buffer overflow

PATCH In review Roel Kluin 4 participants 4 messages Aug 3, 2009 Linux for power macintosh

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 powerpc: Read buffer overflow

Check whether index is within bounds before grabbing the element.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/macintosh/macio_asic.c +4 -2
index a0f6838..588a5b0 100644
@@ -294,10 +294,11 @@ static void macio_setup_interrupts(struct macio_dev *dev)
 	int i = 0, j = 0;
 
 	for (;;) {
-		struct resource *res = &dev->interrupt[j];
+		struct resource *res;
 
 		if (j >= MACIO_DEV_COUNT_IRQS)
 			break;
+		res = &dev->interrupt[j];
 		irq = irq_of_parse_and_map(np, i++);
 		if (irq == NO_IRQ)
 			break;

@@ -321,9 +322,10 @@ static void macio_setup_resources(struct macio_dev *dev,
 	int index;
 
 	for (index = 0; of_address_to_resource(np, index, &r) == 0; index++) {
-		struct resource *res = &dev->resource[index];
+		struct resource *res;
 		if (index >= MACIO_DEV_COUNT_RESOURCES)
 			break;
+		res = &dev->resource[index];
 		*res = r;
 		res->name = dev_name(&dev->ofdev.dev);
#1 lore raw
Quoted 1 line · Roel Kluin

Check whether index is within bounds before grabbing the element.

The change seems unnecessary since we only compute the address of the element before the bounds check, we don't actually access the element. I believe that is legal in C.

Paul.

#2 lore raw
Quoted 7 lines · Paul Mackerras
Quoted 1 line · Roel Kluin

Check whether index is within bounds before grabbing the element.

The change seems unnecessary since we only compute the address of the element before the bounds check, we don't actually access the element. I believe that is legal in C.

I've got this strange feeling of deja vu :)

http://thread.gmane.org/gmane.linux.ports.arm.kernel/63507

(I'd vote for applying it but won't mind if not)

Regards,

Wolfram

Signature · 2 lines
Pengutronix e.K.                           | Wolfram Sang                |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
#3 lore raw
In reply to Paul Mackerras
Quoted 3 lines

The change seems unnecessary since we only compute the address of the element before the bounds check, we don't actually access the element. I believe that is legal in C.

If you have an array a[N], taking &a[0] .. &a[N] are legal C, everything else is not.

Segher