lkml.org 
[lkml]   [2013]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [char-misc-next 2/8] mei: hbm: validate client index is not exceeding allocated array size
Date
> >
> > This somehow should guard buffer overflow allocated of size dev-
> >me_clients_num
> > In theory this can happen only if something go wrong in hardware
> > initialization or there is some other security hole that can change
> > client_num.
>
> What _kind_ of "security hole" could ever change that number? Where
> does it come from? Who can modify it? If you don't know that now then
> we have worse problems...

The allocation of me_clients arrays of mei_clients_num is happening on ME enumeration message,
While the filling out the array is looping over get properties message which is bounded by MEI_CLIENTS_MAX,
so the overflow is indeed possible, of course only on some faulty HW. We had such errors only on new
HW bring ups.

Thanks
Tomas


\
 
 \ /
  Last update: 2013-11-07 14:21    [W:0.536 / U:0.460 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site