All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
@ 2013-05-30  3:35 ` Chen Gang
  0 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-05-30  3:35 UTC (permalink / raw)
  To: David Miller, linux-kernel, Linux-Arch, Sam Ravnborg; +Cc: sparclinux


When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
repeating which may cause memory overflow.

So need additional length check for it in the outside looping.

Also beautify the related code which found by "./scripts/checkpatch.pl"


Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
 arch/sparc/prom/bootstr_32.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c
index f5ec32e..d2b49d2 100644
--- a/arch/sparc/prom/bootstr_32.c
+++ b/arch/sparc/prom/bootstr_32.c
@@ -23,23 +23,25 @@ prom_getbootargs(void)
 		return barg_buf;
 	}
 
-	switch(prom_vers) {
+	switch (prom_vers) {
 	case PROM_V0:
 		cp = barg_buf;
 		/* Start from 1 and go over fd(0,0,0)kernel */
-		for(iter = 1; iter < 8; iter++) {
+		for (iter = 1; iter < 8; iter++) {
 			arg = (*(romvec->pv_v0bootargs))->argv[iter];
 			if (arg == NULL)
 				break;
-			while(*arg != 0) {
+			while (*arg != 0) {
 				/* Leave place for space and null. */
-				if(cp >= barg_buf + BARG_LEN-2){
+				if (cp >= barg_buf + BARG_LEN - 2)
 					/* We might issue a warning here. */
 					break;
-				}
 				*cp++ = *arg++;
 			}
 			*cp++ = ' ';
+			if (cp >= barg_buf + BARG_LEN - 1)
+				/* We might issue a warning here. */
+				break;
 		}
 		*cp = 0;
 		break;
-- 
1.7.7.6

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
@ 2013-05-30  3:35 ` Chen Gang
  0 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-05-30  3:35 UTC (permalink / raw)
  To: David Miller, linux-kernel, Linux-Arch, Sam Ravnborg; +Cc: sparclinux


When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
repeating which may cause memory overflow.

So need additional length check for it in the outside looping.

Also beautify the related code which found by "./scripts/checkpatch.pl"


Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
 arch/sparc/prom/bootstr_32.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c
index f5ec32e..d2b49d2 100644
--- a/arch/sparc/prom/bootstr_32.c
+++ b/arch/sparc/prom/bootstr_32.c
@@ -23,23 +23,25 @@ prom_getbootargs(void)
 		return barg_buf;
 	}
 
-	switch(prom_vers) {
+	switch (prom_vers) {
 	case PROM_V0:
 		cp = barg_buf;
 		/* Start from 1 and go over fd(0,0,0)kernel */
-		for(iter = 1; iter < 8; iter++) {
+		for (iter = 1; iter < 8; iter++) {
 			arg = (*(romvec->pv_v0bootargs))->argv[iter];
 			if (arg = NULL)
 				break;
-			while(*arg != 0) {
+			while (*arg != 0) {
 				/* Leave place for space and null. */
-				if(cp >= barg_buf + BARG_LEN-2){
+				if (cp >= barg_buf + BARG_LEN - 2)
 					/* We might issue a warning here. */
 					break;
-				}
 				*cp++ = *arg++;
 			}
 			*cp++ = ' ';
+			if (cp >= barg_buf + BARG_LEN - 1)
+				/* We might issue a warning here. */
+				break;
 		}
 		*cp = 0;
 		break;
-- 
1.7.7.6

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
  2013-05-30  3:35 ` Chen Gang
@ 2013-06-19  9:13   ` David Miller
  -1 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-06-19  9:13 UTC (permalink / raw)
  To: gang.chen; +Cc: linux-kernel, linux-arch, sam, sparclinux

From: Chen Gang <gang.chen@asianux.com>
Date: Thu, 30 May 2013 11:35:22 +0800

> 
> When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
> but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
> repeating which may cause memory overflow.
> 
> So need additional length check for it in the outside looping.
> 
> Also beautify the related code which found by "./scripts/checkpatch.pl"

Applied.

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
@ 2013-06-19  9:13   ` David Miller
  0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-06-19  9:13 UTC (permalink / raw)
  To: gang.chen; +Cc: linux-kernel, linux-arch, sam, sparclinux

From: Chen Gang <gang.chen@asianux.com>
Date: Thu, 30 May 2013 11:35:22 +0800

> 
> When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
> but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
> repeating which may cause memory overflow.
> 
> So need additional length check for it in the outside looping.
> 
> Also beautify the related code which found by "./scripts/checkpatch.pl"

Applied.

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
  2013-06-19  9:13   ` David Miller
@ 2013-06-19  9:24     ` Chen Gang
  -1 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-06-19  9:24 UTC (permalink / raw)
  To: David Miller; +Cc: linux-kernel, linux-arch, sam, sparclinux

On 06/19/2013 05:13 PM, David Miller wrote:
> From: Chen Gang <gang.chen@asianux.com>
> Date: Thu, 30 May 2013 11:35:22 +0800
> 
>>
>> When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
>> but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
>> repeating which may cause memory overflow.
>>
>> So need additional length check for it in the outside looping.
>>
>> Also beautify the related code which found by "./scripts/checkpatch.pl"
> 
> Applied.
> 
> 

Thank you very much.


-- 
Chen Gang

Asianux Corporation

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping
@ 2013-06-19  9:24     ` Chen Gang
  0 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-06-19  9:24 UTC (permalink / raw)
  To: David Miller; +Cc: linux-kernel, linux-arch, sam, sparclinux

On 06/19/2013 05:13 PM, David Miller wrote:
> From: Chen Gang <gang.chen@asianux.com>
> Date: Thu, 30 May 2013 11:35:22 +0800
> 
>>
>> When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
>> but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
>> repeating which may cause memory overflow.
>>
>> So need additional length check for it in the outside looping.
>>
>> Also beautify the related code which found by "./scripts/checkpatch.pl"
> 
> Applied.
> 
> 

Thank you very much.


-- 
Chen Gang

Asianux Corporation

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-06-19  9:25 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-05-30  3:35 [PATCH] arch: sparc: prom: looping issue, need additional length check in the outside looping Chen Gang
2013-05-30  3:35 ` Chen Gang
2013-06-19  9:13 ` David Miller
2013-06-19  9:13   ` David Miller
2013-06-19  9:24   ` Chen Gang
2013-06-19  9:24     ` Chen Gang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.