Re: [PATCH] evh_bytechan: fix out of bounds accesses
From: Stephen Rothwell <hidden>
Date: 2020-01-13 20:27:29
Attachments
- (unnamed) [application/pgp-signature] 488 bytes
From: Stephen Rothwell <hidden>
Date: 2020-01-13 20:27:29
Hi Timur, On Mon, 13 Jan 2020 10:03:18 -0600 Timur Tabi [off-list ref] wrote:
Why not simply correct the parameters of ev_byte_channel_send? static inline unsigned int ev_byte_channel_send(unsigned int handle, -unsigned int *count, const char buffer[EV_BYTE_CHANNEL_MAX_BYTES]) +unsigned int *count, const char *buffer) Back then, I probably thought I was just being clever with this code, but I realize now that it doesn't make sense to do the way I did.
The problem is not really the declaration, the problem is that ev_byte_channel_send always accesses 16 bytes from the buffer and it is not always passed a buffer that long (in one case it is passed a pointer to a single byte). So the alternative to the memcpy approach I have take is to complicate ev_byte_channel_send so that only accesses count bytes from the buffer. -- Cheers, Stephen Rothwell