Thread (28 messages) 28 messages, 7 authors, 2020-03-17

Re: [PATCH] evh_bytechan: fix out of bounds accesses

From: Timur Tabi <timur@kernel.org>
Date: 2020-01-13 16:05:54

On Thu, Jan 9, 2020 at 1:41 AM Stephen Rothwell [off-list ref] wrote:
ev_byte_channel_send() assumes that its third argument is a 16 byte array.
Some places where it is called it may not be (or we can't easily tell
if it is).  Newer compilers have started producing warnings about this,
so make sure we actually pass a 16 byte array.
...
+static unsigned int local_ev_byte_channel_send(unsigned int handle,
+        unsigned int *count, const char *p)
+{
+       char buffer[EV_BYTE_CHANNEL_MAX_BYTES];
+       unsigned int c = *count;
+
+       if (c < sizeof(buffer)) {
+               memcpy(buffer, p, c);
+               memset(&buffer[c], 0, sizeof(buffer) - c);
+               p = buffer;
+       }
+       return ev_byte_channel_send(handle, count, p);
+}
Why not simply correct the parameters of ev_byte_channel_send?

static inline unsigned int ev_byte_channel_send(unsigned int handle,
-unsigned int *count, const char buffer[EV_BYTE_CHANNEL_MAX_BYTES])
+unsigned int *count, const char *buffer)

Back then, I probably thought I was just being clever with this code,
but I realize now that it doesn't make sense to do the way I did.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help