lkml.org 
[lkml]   [2012]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectarray underflow in receive_SyncParam()?
I had a question about the following code:

drivers/block/drbd/drbd_receiver.c
2808 if (apv == 88) {
2809 if (data_size > SHARED_SECRET_MAX) {
2810 dev_err(DEV, "verify-alg too long, "
2811 "peer wants %u, accepting only %u byte\n",
2812 data_size, SHARED_SECRET_MAX);
2813 return false;
2814 }
2815
2816 if (drbd_recv(mdev, p->verify_alg, data_size) != data_size)
2817 return false;
2818
2819 /* we expect NUL terminated string */
2820 /* but just in case someone tries to be evil */
2821 D_ASSERT(p->verify_alg[data_size-1] == 0);
2822 p->verify_alg[data_size-1] = 0;
^^^^^^^^^
Is it possible for data_size to be zero here leading to an array
underflow? We test for overflows, but I don't see any place where we
test for zero.

regards,
dan carpenter


\
 
 \ /
  Last update: 2012-03-27 09:13    [W:0.028 / U:0.352 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site