redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

arch: sparc: prom: looping issue, need additional length check in the outside looping 

When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
repeating which may cause memory overflow.

So need additional length check for it in the outside looping.

Also beautify the related code which found by "./scripts/checkpatch.pl"

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Chen Gang 2013-05-30 11:35:22 +08:00 committed by David S. Miller
parent dbebe0da64
commit 242ece22f0
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
arch/sparc/prom/bootstr_32.c
View File

@ -33,13 +33,15 @@ prom_getbootargs(void)
break;
while (*arg != 0) {
/* Leave place for space and null. */
if(cp >= barg_buf + BARG_LEN-2){
if (cp >= barg_buf + BARG_LEN - 2)
/* We might issue a warning here. */
break;
}
*cp++ = *arg++;
}
*cp++ = ' ';
if (cp >= barg_buf + BARG_LEN - 1)
/* We might issue a warning here. */
break;
}
*cp = 0;
break;