netdev - Re: [PATCH] af_packet: check loop for greater than zero in tpacket_fill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20120610.201015.1131273088392536549.davem@davemloft.net>
Date:	Sun, 10 Jun 2012 20:10:15 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	danborkmann@...earbox.net
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] af_packet: check loop for greater than zero in
 tpacket_fill_skb

From: Daniel Borkmann <danborkmann@...earbox.net>
Date: Sun, 10 Jun 2012 21:25:08 +0200

> It could be more safe to check the 'to_write' for 'greater than zero'
> instead for 'not zero'. 'to_write' is of type int and subtraction operations
> are performed on it, so in the case of malformed values that are
> subtracted from 'to_write', it could become less than zero, which is then
> interpreted as 'not zero' in the while condition, thus the loop won't
> return as expected.
> 
> Signed-off-by: Daniel Borkmann <daniel.borkmann@....ee.ethz.ch>

I hate this kind of change.

The implication is that there are bugs in the loop that can cause
the value to go negative.

Unless you can show that this actually happens, leave this clean
test alone.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html