[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120327071036.GA19008@elgon.mountain>
Date: Tue, 27 Mar 2012 10:10:36 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: Philipp Reisner <philipp.reisner@...bit.com>
Cc: drbd-user@...ts.linbit.com, linux-kernel@...r.kernel.org
Subject: array underflow in receive_SyncParam()?
I had a question about the following code:
drivers/block/drbd/drbd_receiver.c
2808 if (apv == 88) {
2809 if (data_size > SHARED_SECRET_MAX) {
2810 dev_err(DEV, "verify-alg too long, "
2811 "peer wants %u, accepting only %u byte\n",
2812 data_size, SHARED_SECRET_MAX);
2813 return false;
2814 }
2815
2816 if (drbd_recv(mdev, p->verify_alg, data_size) != data_size)
2817 return false;
2818
2819 /* we expect NUL terminated string */
2820 /* but just in case someone tries to be evil */
2821 D_ASSERT(p->verify_alg[data_size-1] == 0);
2822 p->verify_alg[data_size-1] = 0;
^^^^^^^^^
Is it possible for data_size to be zero here leading to an array
underflow? We test for overflows, but I don't see any place where we
test for zero.
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists