From: Dan Carpenter <dan.carpenter@oracle•com>
To: gang.chen@asianux•com
Cc: netdev@vger•kernel.org
Subject: re: drivers/isdn: checkng length to be sure not memory overflow
Date: Thu, 23 May 2013 00:05:22 +0300 [thread overview]
Message-ID: <20130522210522.GA2800@elgon.mountain> (raw)
Hello Chen Gang,
The patch f39479363e03: "drivers/isdn: checkng length to be sure not
memory overflow" from Mar 7, 2013, leads to the following static checker
warning:
"drivers/isdn/i4l/isdn_tty.c:969 isdn_tty_send_msg()
error: buffer overflow 'cmd.parm.cmsg.para' 50 <= 73"
drivers/isdn/i4l/isdn_tty.c
905 l = min(strlen(msg), sizeof(cmd.parm) - sizeof(cmd.parm.cmsg)
906 + sizeof(cmd.parm.cmsg.para) - 2);
907
[ snip ]
963 cmd.parm.cmsg.Length = l + 14;
964 cmd.parm.cmsg.Command = CAPI_MANUFACTURER;
965 cmd.parm.cmsg.Subcommand = CAPI_REQ;
966 cmd.parm.cmsg.adr.Controller = info->isdn_driver + 1;
967 cmd.parm.cmsg.para[0] = l + 1;
968 strncpy(&cmd.parm.cmsg.para[1], msg, l);
969 cmd.parm.cmsg.para[l + 1] = 0xd;
^^^^^^^
"l" is more than sizeof(cmd.parm.cmsg.para) here so it is an overflow.
As far as I can see the correct limit should be:
l = min(strlen(msg), sizeof(cmd.parm.cmsg.para) - 2);
The "- 2" is so that ".cmsg.para[l + 1] = 0xd" does not overflow.
regards,
dan carpenter
next reply other threads:[~2013-05-22 21:05 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-22 21:05 Dan Carpenter [this message]
2013-05-23 1:24 ` drivers/isdn: checkng length to be sure not memory overflow Chen Gang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130522210522.GA2800@elgon.mountain \
--to=dan.carpenter@oracle$(echo .)com \
--cc=gang.chen@asianux$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox