Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-18 Thread Dan Carpenter
On Mon, Jul 17, 2017 at 08:21:20PM -0400, Jacob von Chorus wrote: > On Mon, Jul 17, 2017 at 10:53:25PM +0300, Dan Carpenter wrote: > > > + if (len + 1 > n) { > > > > It's more idiomatic to say "if (len >= n)". Plus that's a good habbit > > My reasoning behind using "((len + 1) > n)" is that len

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-18 Thread Dan Carpenter
On Mon, Jul 17, 2017 at 08:21:20PM -0400, Jacob von Chorus wrote: > On Mon, Jul 17, 2017 at 10:53:25PM +0300, Dan Carpenter wrote: > > > + if (len + 1 > n) { > > > > It's more idiomatic to say "if (len >= n)". Plus that's a good habbit > > My reasoning behind using "((len + 1) > n)" is that len

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Jacob von Chorus
On Mon, Jul 17, 2017 at 10:53:25PM +0300, Dan Carpenter wrote: > > + if (len + 1 > n) { > > It's more idiomatic to say "if (len >= n)". Plus that's a good habbit My reasoning behind using "((len + 1) > n)" is that len represents the length of the string without null-termination. "buf" is

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Jacob von Chorus
On Mon, Jul 17, 2017 at 10:53:25PM +0300, Dan Carpenter wrote: > > + if (len + 1 > n) { > > It's more idiomatic to say "if (len >= n)". Plus that's a good habbit My reasoning behind using "((len + 1) > n)" is that len represents the length of the string without null-termination. "buf" is

[PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Jacob von Chorus
Four fields in struct fpgaimage are char arrays of length MAX_STR (256). The amount of data read into these buffers is controlled by a length field in the bitstream file read from userspace. If a corrupt or malicious firmware file was supplied, kernel data beyond these buffers can be overwritten

[PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Jacob von Chorus
Four fields in struct fpgaimage are char arrays of length MAX_STR (256). The amount of data read into these buffers is controlled by a length field in the bitstream file read from userspace. If a corrupt or malicious firmware file was supplied, kernel data beyond these buffers can be overwritten

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Dan Carpenter
On Sun, Jul 16, 2017 at 08:38:41PM -0400, Jacob von Chorus wrote: > diff --git a/drivers/staging/gs_fpgaboot/gs_fpgaboot.c > b/drivers/staging/gs_fpgaboot/gs_fpgaboot.c > index 19b550fff0..2aafd769b8 100644 > --- a/drivers/staging/gs_fpgaboot/gs_fpgaboot.c > +++

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Dan Carpenter
On Sun, Jul 16, 2017 at 08:38:41PM -0400, Jacob von Chorus wrote: > diff --git a/drivers/staging/gs_fpgaboot/gs_fpgaboot.c > b/drivers/staging/gs_fpgaboot/gs_fpgaboot.c > index 19b550fff0..2aafd769b8 100644 > --- a/drivers/staging/gs_fpgaboot/gs_fpgaboot.c > +++

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Greg Kroah-Hartman
On Sun, Jul 16, 2017 at 08:38:41PM -0400, Jacob von Chorus wrote: > Four fields in struct fpgaimage are char arrays of length MAX_STR (256). > The amount of data read into these buffers is controlled by a length > field in the bitstream file read from userspace. If a corrupt or > malicious

Re: [PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-17 Thread Greg Kroah-Hartman
On Sun, Jul 16, 2017 at 08:38:41PM -0400, Jacob von Chorus wrote: > Four fields in struct fpgaimage are char arrays of length MAX_STR (256). > The amount of data read into these buffers is controlled by a length > field in the bitstream file read from userspace. If a corrupt or > malicious

[PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-16 Thread Jacob von Chorus
Four fields in struct fpgaimage are char arrays of length MAX_STR (256). The amount of data read into these buffers is controlled by a length field in the bitstream file read from userspace. If a corrupt or malicious firmware file was supplied, kernel data beyond these buffers can be overwritten

[PATCH] staging: gs_fpgaboot: add buffer overflow checks

2017-07-16 Thread Jacob von Chorus
Four fields in struct fpgaimage are char arrays of length MAX_STR (256). The amount of data read into these buffers is controlled by a length field in the bitstream file read from userspace. If a corrupt or malicious firmware file was supplied, kernel data beyond these buffers can be overwritten