Re: [PATCH] evh_bytechan: fix out of bounds accesses

From
Timur Tabi <timur@kernel.org>
Date
2020-01-13 16:05:54
Reply to
Stephen Rothwell, 2020-01-09
On Thu, Jan 9, 2020 at 1:41 AM Stephen Rothwell [off-list ref] wrote:
ev_byte_channel_send() assumes that its third argument is a 16 byte array.
Some places where it is called it may not be (or we can't easily tell
if it is).  Newer compilers have started producing warnings about this,
so make sure we actually pass a 16 byte array.
...
quoted hunk ↗ jump to hunk
+static unsigned int local_ev_byte_channel_send(unsigned int handle,
+        unsigned int *count, const char *p)
+{
+       char buffer[EV_BYTE_CHANNEL_MAX_BYTES];
+       unsigned int c = *count;
+
+       if (c < sizeof(buffer)) {
+               memcpy(buffer, p, c);
+               memset(&buffer[c], 0, sizeof(buffer) - c);
+               p = buffer;
+       }
+       return ev_byte_channel_send(handle, count, p);
+}
Why not simply correct the parameters of ev_byte_channel_send?

static inline unsigned int ev_byte_channel_send(unsigned int handle,
-unsigned int *count, const char buffer[EV_BYTE_CHANNEL_MAX_BYTES])
+unsigned int *count, const char *buffer)

Back then, I probably thought I was just being clever with this code,
but I realize now that it doesn't make sense to do the way I did.
Thread (28 messages) 28 messages, 7 authors, last reply 2020-03-17
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help