lkml.org 
[lkml]   [2021]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] char: pcmcia: fix possible array index out of bounds in set_protocol()
From
Date
On 2021/05/21 18:59, Greg KH wrote:
> On Fri, May 21, 2021 at 06:07:05PM +0800, Yu Kuai wrote:
>> The length of array 'pts_reply' is 4, and the loop in set_protocol()
>> will access array element from 0 to num_bytes_read - 1. Thus if
>> io_read_num_rec_bytes() gets 'num_bytes_read' more than 4, it will
>> cause index out of bounds errors.
>
> And how can num_bytes_read be greater than 4?

Hi

Do you mean num_bytes_read here should never be greater than 4?

544 io_read_num_rec_bytes(iobase, &num_bytes_read);
545 if (num_bytes_read >= 4) {
546 DEBUGP(2, dev, "NumRecBytes = %i\n",
num_bytes_read);
547 break;


>
> Ah, it is tested, but you might want to error out if that happens, as
> obviously something went wrong.
>
> Do you have this hardware to test these changes?

Sorry we don't have this hardware...

Thanks,
Yu Kuai
>
> thanks,
>
> greg k-h
> .
>

\
 
 \ /
  Last update: 2021-05-21 13:35    [W:0.036 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site