Thread (28 messages) 28 messages, 7 authors, 2020-03-17

Re: [PATCH] evh_bytechan: fix out of bounds accesses

From: Stephen Rothwell <hidden>
Date: 2020-01-13 20:27:29

Hi Timur,

On Mon, 13 Jan 2020 10:03:18 -0600 Timur Tabi [off-list ref] wrote:
Why not simply correct the parameters of ev_byte_channel_send?

static inline unsigned int ev_byte_channel_send(unsigned int handle,
-unsigned int *count, const char buffer[EV_BYTE_CHANNEL_MAX_BYTES])
+unsigned int *count, const char *buffer)

Back then, I probably thought I was just being clever with this code,
but I realize now that it doesn't make sense to do the way I did.
The problem is not really the declaration, the problem is that
ev_byte_channel_send always accesses 16 bytes from the buffer and it is
not always passed a buffer that long (in one case it is passed a
pointer to a single byte).  So the alternative to the memcpy approach I
have take is to complicate ev_byte_channel_send so that only accesses
count bytes from the buffer.

-- 
Cheers,
Stephen Rothwell

Attachments

  • (unnamed) [application/pgp-signature] 488 bytes
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help