Thread (4 messages) 4 messages, 3 authors, 2012-05-05

Re: [patch] max17042_battery: fix a couple buffer overflows

From: Anton Vorontsov <hidden>
Date: 2012-05-05 02:28:09
Also in: kernel-janitors, lkml

On Thu, Mar 15, 2012 at 10:20:34AM -0700, Dirk Brandewie wrote:
On 03/15/2012 04:37 AM, Dan Carpenter wrote:
quoted
There are a couple issues here caused by confusion between sizeof()
and ARRAY_SIZE().  "table_size" should be the number of elements, but we
should allocate it with kcalloc() so that we allocate the correct number
of bytes.

In max17042_init_model() we don't allocate enough space so we go past
the end of the array in max17042_read_model_data() and
max17042_model_data_compare().

In max17042_verify_model_lock() we allocate the right amount of space
but we call max17042_read_model_data() with the wrong number of elements
and also in the for loop we go past the end of the array.

Signed-off-by: Dan Carpenter<redacted>
Acked-by: Dirk Brandewie <redacted>

Typo in first ack :-(
Applied, thanks! :-)

-- 
Anton Vorontsov
Email: cbouatmailru@gmail.com
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help