* [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds
@ 2015-03-14 12:46 Ameen Ali
2015-03-14 15:58 ` Richard Weinberger
2015-03-16 14:22 ` One Thousand Gnomes
0 siblings, 2 replies; 3+ messages in thread
From: Ameen Ali @ 2015-03-14 12:46 UTC (permalink / raw)
To: jslaby, tiwai, joe; +Cc: linux-kernel, Ameen Ali
make sure that out-of-bounds never happens
Signed-off-by : Ameen Ali <AmeenAli023@gmail.com>
---
drivers/tty/vt/vt.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 6e00572..cf73e92 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
i++;
if (i > vc->vc_npar)
break;
- if (vc->vc_par[i] == 5 && /* 256 colours */
- i < vc->vc_npar) { /* ubiquitous */
+ if (i < vc->vc_npar && /* 256 colours */
+ vc->vc_par[i] == 5) { /* ubiquitous */
i++;
rgb_foreground(vc,
rgb_from_256(vc->vc_par[i]));
- } else if (vc->vc_par[i] == 2 && /* 24 bit */
- i <= vc->vc_npar + 3) {/* extremely rare */
+ } else if (i <= vc->vc_npar + 3 && /* 24 bit */
+ vc->vc_par[i] == 2) {/* extremely rare */
struct rgb c = {
.r = vc->vc_par[i + 1],
.g = vc->vc_par[i + 2],
@@ -1387,13 +1387,13 @@ static void csi_m(struct vc_data *vc)
i++;
if (i > vc->vc_npar)
break;
- if (vc->vc_par[i] == 5 && /* 256 colours */
- i < vc->vc_npar) {
+ if (i < vc->vc_npar && /* 256 colours */
+ vc->vc_par[i] == 5) {
i++;
rgb_background(vc,
rgb_from_256(vc->vc_par[i]));
- } else if (vc->vc_par[i] == 2 && /* 24 bit */
- i <= vc->vc_npar + 3) {
+ } else if (i <= vc->vc_npar + 3 && /* 24 bit */
+ vc->vc_par[i] == 2 ) {
struct rgb c = {
.r = vc->vc_par[i + 1],
.g = vc->vc_par[i + 2],
--
2.1.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds
2015-03-14 12:46 [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds Ameen Ali
@ 2015-03-14 15:58 ` Richard Weinberger
2015-03-16 14:22 ` One Thousand Gnomes
1 sibling, 0 replies; 3+ messages in thread
From: Richard Weinberger @ 2015-03-14 15:58 UTC (permalink / raw)
To: Ameen Ali; +Cc: Jiri Slaby, Takashi Iwai, Joe Perches, LKML
On Sat, Mar 14, 2015 at 1:46 PM, Ameen Ali <ameenali023@gmail.com> wrote:
> make sure that out-of-bounds never happens
Can it actually happen?
Isn't i guaranteed to be within bounds?
> Signed-off-by : Ameen Ali <AmeenAli023@gmail.com>
> ---
> drivers/tty/vt/vt.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 6e00572..cf73e92 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
> i++;
> if (i > vc->vc_npar)
> break;
> - if (vc->vc_par[i] == 5 && /* 256 colours */
> - i < vc->vc_npar) { /* ubiquitous */
> + if (i < vc->vc_npar && /* 256 colours */
> + vc->vc_par[i] == 5) { /* ubiquitous */
> i++;
> rgb_foreground(vc,
> rgb_from_256(vc->vc_par[i]));
> - } else if (vc->vc_par[i] == 2 && /* 24 bit */
> - i <= vc->vc_npar + 3) {/* extremely rare */
> + } else if (i <= vc->vc_npar + 3 && /* 24 bit */
> + vc->vc_par[i] == 2) {/* extremely rare */
> struct rgb c = {
> .r = vc->vc_par[i + 1],
> .g = vc->vc_par[i + 2],
> @@ -1387,13 +1387,13 @@ static void csi_m(struct vc_data *vc)
> i++;
> if (i > vc->vc_npar)
> break;
> - if (vc->vc_par[i] == 5 && /* 256 colours */
> - i < vc->vc_npar) {
> + if (i < vc->vc_npar && /* 256 colours */
> + vc->vc_par[i] == 5) {
> i++;
> rgb_background(vc,
> rgb_from_256(vc->vc_par[i]));
> - } else if (vc->vc_par[i] == 2 && /* 24 bit */
> - i <= vc->vc_npar + 3) {
> + } else if (i <= vc->vc_npar + 3 && /* 24 bit */
> + vc->vc_par[i] == 2 ) {
> struct rgb c = {
> .r = vc->vc_par[i + 1],
> .g = vc->vc_par[i + 2],
> --
> 2.1.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
--
Thanks,
//richard
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds
2015-03-14 12:46 [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds Ameen Ali
2015-03-14 15:58 ` Richard Weinberger
@ 2015-03-16 14:22 ` One Thousand Gnomes
1 sibling, 0 replies; 3+ messages in thread
From: One Thousand Gnomes @ 2015-03-16 14:22 UTC (permalink / raw)
To: Ameen Ali; +Cc: jslaby, tiwai, joe, linux-kernel
On Sat, 14 Mar 2015 14:46:22 +0200
Ameen Ali <ameenali023@gmail.com> wrote:
> make sure that out-of-bounds never happens
>
> Signed-off-by : Ameen Ali <AmeenAli023@gmail.com>
> ---
> drivers/tty/vt/vt.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 6e00572..cf73e92 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
> i++;
> if (i > vc->vc_npar)
> break;
It's checked in advance ^^^^^^^^^^^^^^^^^^^^^^^^^^
I guess whatever tool you used to verify it is concerned about the case
of i == vc->vc_npar ?
Alan
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-03-16 14:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-14 12:46 [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds Ameen Ali
2015-03-14 15:58 ` Richard Weinberger
2015-03-16 14:22 ` One Thousand Gnomes
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).