Messages in this thread | | | From | "Winkler, Tomas" <> | Subject | RE: [char-misc-next 2/8] mei: hbm: validate client index is not exceeding allocated array size | Date | Thu, 7 Nov 2013 12:21:54 +0000 |
| |
> > > > This somehow should guard buffer overflow allocated of size dev- > >me_clients_num > > In theory this can happen only if something go wrong in hardware > > initialization or there is some other security hole that can change > > client_num. > > What _kind_ of "security hole" could ever change that number? Where > does it come from? Who can modify it? If you don't know that now then > we have worse problems...
The allocation of me_clients arrays of mei_clients_num is happening on ME enumeration message, While the filling out the array is looping over get properties message which is bounded by MEI_CLIENTS_MAX, so the overflow is indeed possible, of course only on some faulty HW. We had such errors only on new HW bring ups.
Thanks Tomas
| |