Messages in this thread |  | | From | "Charley (Hao Chuan) Chu" <> | Subject | RE: [PATCH] FS: Fixed buffer overflow issue in seq_read() | Date | Tue, 19 Nov 2013 21:22:58 +0000 |
| |
> m->from is a red herring - it's not even looked at if m->count is 0.
Then, shall the initialization here be removed too?
@@ -90,7 +90,7 @@ static int traverse(struct seq_file *m, loff_t offset)
m->version = 0; index = 0; - m->count = m->from = 0; + m->count = 0; if (!offset) { m->index = index; return 0;
> What do you think about then just abstracing out that now common sequence > of re-allocating a larger buffer, while clearing m->count?
Following code is duplicated (slightly different) in both seq_read() and seq_lseek(). It would be nice to have them consolidated in traverse().
while ((err = traverse(m, *ppos)) == -EAGAIN) ; if (err) { /* With prejudice... */ m->read_pos = 0; m->version = 0; m->index = 0; m->count = 0; goto Done; } else { m->read_pos = *ppos; }
Thanks, Charley
|  |