linux-kernel - Re: [PATCH] gigaset: gigaset_isowbuf_getbytes() may return signed unnoticed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 25 Apr 2008 11:29:08 +0200
From:	Tilman Schmidt <tilman@...p.cc>
To:	Roel Kluin <12o3l@...cali.nl>
CC:	hjlipp@....de, gigaset307x-common@...ts.sourceforge.net,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] gigaset: gigaset_isowbuf_getbytes() may return signed
 unnoticed

Am 23.04.2008 23:27 schrieb Roel Kluin:
> ifd->offset is unsigned. gigaset_isowbuf_getbytes() may return signed unnoticed

Thanks, good catch. I wonder why neither sparse nor gcc emitted
a warning for that.

> --- a/drivers/isdn/gigaset/bas-gigaset.c
> +++ b/drivers/isdn/gigaset/bas-gigaset.c
> @@ -1050,9 +1050,9 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
>  		}
>  
>  		/* retrieve block of data to send */
> -		ifd->offset = gigaset_isowbuf_getbytes(ubc->isooutbuf,
> -						       ifd->length);
> -		if (ifd->offset < 0) {
> +		rc = gigaset_isowbuf_getbytes(ubc->isooutbuf, ifd->length);
> +		ifd->offset = rc;
> +		if (rc < 0) {
>  			if (ifd->offset == -EBUSY) {
>  				gig_dbg(DEBUG_ISO,
>  					"%s: buffer busy at frame %d",

Please, also replace ifd->offset by rc in the body of the "if (rc < 0)"
and put the assignment to ifd->offset behind it so that it is only done
if rc >= 0. (Frame *ifd is not used in the < 0 case.)

Thanks,
Tilman

-- 
Tilman Schmidt                    E-Mail: tilman@...p.cc
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)


Download attachment "signature.asc" of type "application/pgp-signature" (251 bytes)