All of lore.kernel.org
 help / color / mirror / Atom feed
From: Johan Hedberg <johan.hedberg@gmail.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: linux-bluetooth@vger.kernel.org
Subject: Re: [RFC] Bluetooth: don't increment twice in eir_has_data_type()
Date: Mon, 26 Mar 2012 14:30:54 +0300	[thread overview]
Message-ID: <20120326113054.GA15616@x220> (raw)
In-Reply-To: <20120322062801.GA3232@mwanda>

Hi Dan,

On Thu, Mar 22, 2012, Dan Carpenter wrote:
> On Wed, Mar 21, 2012 at 07:06:32PM -0300, Johan Hedberg wrote:
> > Looks like the original code is indeed buggy, no idea how I didn't
> > notice something that obvious. Your patch does however seem to change
> > the behavior a bit, a valid tag would be detected even though its length
> > would be invalid (pointing outside of the supplied data). Not sure if
> > that's so critical though since the important thing is to keep the code
> > from doing anything nasty when supplied invalid data.
> > 
> 
> We should check the length.  It will just cause headaches if we
> don't.
> 
> It would be simple enough for me to put back the check I removed
> from the middle of the loop.  But the thing is I wasn't sure how all
> the + 1 and - 1 things fit together so I didn't feel good about
> signing off on this.  Could you send a patch?  That way I get a
> reported-by tag but if there are any problems you get blamed while I
> deny knowing anything about it.  ;)

Done. I also sent a second patch for another issue with the function.

In case you're interested the EIR data format is quite simple,
consisting of a sequence of data structures with a format of:

	| data_len (1 byte) | data (data_len bytes) |

The first byte of "data" is the type of data structure in question. EIR
data buffers do not need to be completely filled up, i.e. they can
contain a non-significant part at the end, the beginning of which can be
detected by a data_len field with the value of 0.

Johan

      reply	other threads:[~2012-03-26 11:30 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-03-20 15:06 [RFC] Bluetooth: don't increment twice in eir_has_data_type() Dan Carpenter
2012-03-21 22:06 ` Johan Hedberg
2012-03-22  6:28   ` Dan Carpenter
2012-03-26 11:30     ` Johan Hedberg [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20120326113054.GA15616@x220 \
    --to=johan.hedberg@gmail.com \
    --cc=dan.carpenter@oracle.com \
    --cc=linux-bluetooth@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.