Messages in this thread | | | Date | Tue, 27 Mar 2012 10:10:36 +0300 | From | Dan Carpenter <> | Subject | array underflow in receive_SyncParam()? |
| |
I had a question about the following code:
drivers/block/drbd/drbd_receiver.c 2808 if (apv == 88) { 2809 if (data_size > SHARED_SECRET_MAX) { 2810 dev_err(DEV, "verify-alg too long, " 2811 "peer wants %u, accepting only %u byte\n", 2812 data_size, SHARED_SECRET_MAX); 2813 return false; 2814 } 2815 2816 if (drbd_recv(mdev, p->verify_alg, data_size) != data_size) 2817 return false; 2818 2819 /* we expect NUL terminated string */ 2820 /* but just in case someone tries to be evil */ 2821 D_ASSERT(p->verify_alg[data_size-1] == 0); 2822 p->verify_alg[data_size-1] = 0; ^^^^^^^^^ Is it possible for data_size to be zero here leading to an array underflow? We test for overflows, but I don't see any place where we test for zero.
regards, dan carpenter
| |