Hi Omar Ramirez Luna: Since you are really too busy. is it suitable to send a patch for it, by me ?
no reply within a week, means it is suitable. :-) gchen. 于 2012年12月14日 11:50, Chen Gang 写道: > Hello Omar Ramirez Luna: > > in drivers/staging/tidspbridge/rmgr/proc.c: > > if strlen(drv_datap->base_img) == size, will pass checking (line 397) > the size is the full length of exec_file (line 382, line 468..469) > strcpy causes issue: src len is strlen(drv_datap->base_img) + '\0'. (line > 400) > > strncpy seems also has issue: need use size instead of strlen(iva_img) + > 1. (line 402..403) > > please help to check, thanks. > > gchen. > > > 380 static int get_exec_file(struct cfg_devnode *dev_node_obj, > 381 struct dev_object *hdev_obj, > 382 u32 size, char *exec_file) > 383 { > 384 u8 dev_type; > 385 s32 len; > 386 struct drv_data *drv_datap = dev_get_drvdata(bridge); > 387 > 388 dev_get_dev_type(hdev_obj, (u8 *) &dev_type); > 389 > 390 if (!exec_file) > 391 return -EFAULT; > 392 > 393 if (dev_type == DSP_UNIT) { > 394 if (!drv_datap || !drv_datap->base_img) > 395 return -EFAULT; > 396 > 397 if (strlen(drv_datap->base_img) > size) > 398 return -EINVAL; > 399 > 400 strcpy(exec_file, drv_datap->base_img); > 401 } else if (dev_type == IVA_UNIT && iva_img) { > 402 len = strlen(iva_img); > 403 strncpy(exec_file, iva_img, len + 1); > 404 } else { > 405 return -ENOENT; > 406 } > 407 > 408 return 0; > 409 } > 410 > ... > > 465 /* Get the default executable for this board... */ > 466 dev_get_dev_type(hdev_obj, (u8 *) &dev_type); > 467 p_proc_object->processor_id = dev_type; > 468 status = get_exec_file(dev_node_obj, hdev_obj, > sizeof(sz_exec_file), > 469 sz_exec_file); > -- Chen Gang Asianux Corporation -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/