Thread (9 messages) 9 messages, 3 authors, 2009-07-30

Re: [PATCH] eexpress: Read buffer overflow

From: David Miller <davem@davemloft.net>
Date: 2009-07-30 20:28:17

From: Jarek Poplawski <redacted>
Date: Wed, 29 Jul 2009 22:05:17 +0200
On Wed, Jul 29, 2009 at 03:18:56PM +0200, Roel Kluin wrote:
quoted
start_code is 69 words, but the code always writes a multiple of 16 words,
so the last 11 words written are outside the array.

Signed-off-by: Roel Kluin <redacted>
---
quoted
Now you seem to make my previous math working :-)
quoted
quoted
(max) i = 64, (max) j = 14, (64+14+16)/2 = 47 < 69, so it seems to copy
less than its size?
Jarek P.
You're right, thanks for reviewing, this one should be correct.
Looks OK to me.
Applied.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help