Messages in this thread Patch in this message | | | From | Chris Packham <> | Subject | [PATCH] tipc: Avoid copying bytes beyond the supplied data | Date | Thu, 2 May 2019 15:10:04 +1200 |
| |
TLV_SET is called with a data pointer and a len parameter that tells us how many bytes are pointed to by data. When invoking memcpy() we need to careful to only copy len bytes.
Previously we would copy TLV_LENGTH(len) bytes which would copy an extra 4 bytes past the end of the data pointer which newer GCC versions complain about.
In file included from test.c:17: In function 'TLV_SET', inlined from 'test' at test.c:186:5: /usr/include/linux/tipc_config.h:317:3: warning: 'memcpy' forming offset [33, 36] is out of the bounds [0, 32] of object 'bearer_name' with type 'char[32]' [-Warray-bounds] memcpy(TLV_DATA(tlv_ptr), data, tlv_len); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ test.c: In function 'test': test.c::161:10: note: 'bearer_name' declared here char bearer_name[TIPC_MAX_BEARER_NAME]; ^~~~~~~~~~~
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz> --- include/uapi/linux/tipc_config.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/tipc_config.h b/include/uapi/linux/tipc_config.h index 4b2c93b1934c..f65c5b80ed33 100644 --- a/include/uapi/linux/tipc_config.h +++ b/include/uapi/linux/tipc_config.h @@ -308,7 +308,7 @@ static inline int TLV_SET(void *tlv, __u16 type, void *data, __u16 len) tlv_ptr->tlv_type = htons(type); tlv_ptr->tlv_len = htons(tlv_len); if (len && data) - memcpy(TLV_DATA(tlv_ptr), data, tlv_len); + memcpy(TLV_DATA(tlv_ptr), data, len); return TLV_SPACE(len); } -- 2.21.0
| |