On Mon, 2013-01-28 at 13:51 +0100, Alexandre SIMON wrote: > [Serge E. Hallyn] wrote the following on [26/01/2013 23:01]: > > Quoting Alexandre SIMON ([email protected]): [...] > >> --- a/kernel/printk.c > >> +++ b/kernel/printk.c > >> @@ -633,8 +633,18 @@ static void call_console_drivers(unsigned start, > >> unsigned end) > >> start_print = start; > >> while (cur_index != end) { > >> if (msg_level < 0 && ((end - cur_index) > 2)) { > >> + /* > >> + * prepare buf_prefix, as a contiguous array, > >> + * to be processed by log_prefix function > >> + */ > >> + char buf_prefix[SYSLOG_PRI_MAX_LENGTH+1]; > >> + unsigned i; > >> + for (i = 0; i < ((end - cur_index)) && (i < > >> SYSLOG_PRI_MAX_LENGTH); i++) { > >> + buf_prefix[i] = LOG_BUF(cur_index + i); > >> + } > > > > You're not guaranteeing that bug_prefix ends with a '\0'. (I'd assume > > LOG_BUF(end) is '\0', and you don't copy it) Is that guaranteed some > > other way? If not, does that not introduce new potential bugginess when > > doing the simple_strtoul()? > > You are totally right. > > It can be fixed with just a line after the loop block : > for (i = 0; i < ((end - cur_index)) && (i < SYSLOG_PRI_MAX_LENGTH); i++) { > ... > } > buf_prefix[i] = '\0'; /* force \0 as last string character */ > > => If you agree, I can re-post the entire patch with this add. > > Just for me : you told about something that "LOG_BUF(end) is '\0'". > I did not see it in the code. Maybe the initialization is not obvious. [...]
I think you're right. You may as well fix both bugs at the same time.
Please do send a new patch.
Ben.
--
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
- Albert Einstein
signature.asc
Description: This is a digitally signed message part
