Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754805AbbEZNcw (ORCPT ); Tue, 26 May 2015 09:32:52 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:30576 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753424AbbEZNcs (ORCPT ); Tue, 26 May 2015 09:32:48 -0400 Date: Tue, 26 May 2015 16:32:21 +0300 From: Dan Carpenter To: "Jason A. Donenfeld" , Shigekatsu Tateno Cc: oss-security , linux-kernel@vger.kernel.org, Greg Kroah-Hartman , devel@driverdev.osuosl.org Subject: Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow Message-ID: <20150526133221.GG11588@mwanda> References: <1431543500-4847-1-git-send-email-Jason@zx2c4.com> <1432642669-7289-1-git-send-email-Jason@zx2c4.com> <1432642669-7289-2-git-send-email-Jason@zx2c4.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1432642669-7289-2-git-send-email-Jason@zx2c4.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 738 Lines: 22 On Tue, May 26, 2015 at 02:17:46PM +0200, Jason A. Donenfeld wrote: > + data_len = elt->length - > sizeof(struct oz_get_desc_rsp) + 1; This was in the original code, but I wonder where the + 1 comes from. Does anyone know? To be honest, I would prefer if we just checked: if (elt->length < sizeof(struct oz_get_desc_rsp) + 1) return; data_len = elt->length - sizeof(struct oz_get_desc_rsp) + 1; Shouldn't there be an upper bound on length? Shigekatsu? regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/