leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: Fix buffer overrun error in netconsole

Browse Source 
Need to not access the byte after the input_buffer.

Reported-by: Coverity (CID: 144423)
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
This commit is contained in:
Joe Hershberger 2017-08-30 17:32:31 -05:00
parent 4bf56913d0
commit 3cacc6a772
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/net/netconsole.c
View File

@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port,
len = sizeof(input_buffer) - input_size; len = sizeof(input_buffer) - input_size;
end = input_offset + input_size; end = input_offset + input_size;
if (end > sizeof(input_buffer)) if (end >= sizeof(input_buffer))
end -= sizeof(input_buffer); end -= sizeof(input_buffer);
chunk = len; chunk = len;
if (end + len > sizeof(input_buffer)) { /* Check if packet will wrap in input_buffer */
if (end + len >= sizeof(input_buffer)) {
chunk = sizeof(input_buffer) - end; chunk = sizeof(input_buffer) - end;
/* Copy the second part of the pkt to start of input_buffer */
memcpy(input_buffer, pkt + chunk, len - chunk); memcpy(input_buffer, pkt + chunk, len - chunk);
} }
/* Copy first (or only) part of pkt after end of current valid input*/
memcpy(input_buffer + end, pkt, chunk); memcpy(input_buffer + end, pkt, chunk);
input_size += len; input_size += len;