On Tue, Jan 14, 2020 at 03:50:22PM +0000, Asmaa Mnebhi wrote: > Reviewed-by: Asmaa Mnebhi <[email protected]>
Thanks, I've picked this up in my next tree. -corey > > -----Original Message----- > From: Colin King <[email protected]> > Sent: Tuesday, January 14, 2020 9:41 AM > To: Corey Minyard <[email protected]>; Arnd Bergmann <[email protected]>; Greg > Kroah-Hartman <[email protected]>; Vadim Pasternak > <[email protected]>; Asmaa Mnebhi <[email protected]>; > [email protected] > Cc: [email protected]; [email protected] > Subject: [PATCH][next] drivers: ipmi: fix off-by-one bounds check that leads > to a out-of-bounds write > > From: Colin Ian King <[email protected]> > > The end of buffer check is off-by-one since the check is against an index > that is pre-incremented before a store to buf[]. Fix this adjusting the > bounds check appropriately. > > Addresses-Coverity: ("Out-of-bounds write") > Fixes: 51bd6f291583 ("Add support for IPMB driver") > Signed-off-by: Colin Ian King <[email protected]> > --- > drivers/char/ipmi/ipmb_dev_int.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/ipmi/ipmb_dev_int.c > b/drivers/char/ipmi/ipmb_dev_int.c > index 9fdae83e59e0..382b28f1cf2f 100644 > --- a/drivers/char/ipmi/ipmb_dev_int.c > +++ b/drivers/char/ipmi/ipmb_dev_int.c > @@ -279,7 +279,7 @@ static int ipmb_slave_cb(struct i2c_client *client, > break; > > case I2C_SLAVE_WRITE_RECEIVED: > - if (ipmb_dev->msg_idx >= sizeof(struct ipmb_msg)) > + if (ipmb_dev->msg_idx >= sizeof(struct ipmb_msg) - 1) > break; > > buf[++ipmb_dev->msg_idx] = *val; > -- > 2.24.0 > _______________________________________________ Openipmi-developer mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openipmi-developer
