2011-08-16 09:51:36

by Pavel Raiskup

Subject: [PATCH 7/8] Possible static overrun removed

There will be static overrun on c_brf_chip array when brf_chip
is greater than 7.
---
tools/hciattach_tialt.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/tools/hciattach_tialt.c b/tools/hciattach_tialt.c
index 1ba009c..fc3ed20 100644
--- a/tools/hciattach_tialt.c
+++ b/tools/hciattach_tialt.c
@@ -234,7 +234,8 @@ int texasalt_init(int fd, int speed, struct termios
*ti)
((brf_chip > 7) ? "unknown" : c_brf_chip[brf_chip]),
brf_chip);

- sprintf(fw, "/etc/firmware/%s.bin", c_brf_chip[brf_chip]);
+ sprintf(fw, "/etc/firmware/%s.bin",
+ brf_chip > 7 ? "unknown" : c_brf_chip[brf_chip]);
texas_load_firmware(fd, fw);

texas_change_speed(fd, speed);
--
1.7.4.4

2011-08-30 13:17:03

by Pavel Raiskup

Subject: [PATCH 7/8] Possible static overrun removed

There will be static overrun on c_brf_chip array when brf_chip
is greater than 7.
---
tools/hciattach_tialt.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/tools/hciattach_tialt.c b/tools/hciattach_tialt.c
index 1ba009c..fc3ed20 100644
--- a/tools/hciattach_tialt.c
+++ b/tools/hciattach_tialt.c
@@ -234,7 +234,8 @@ int texasalt_init(int fd, int speed, struct termios *ti)
((brf_chip > 7) ? "unknown" : c_brf_chip[brf_chip]),
brf_chip);

- sprintf(fw, "/etc/firmware/%s.bin", c_brf_chip[brf_chip]);
+ sprintf(fw, "/etc/firmware/%s.bin",
+ brf_chip > 7 ? "unknown" : c_brf_chip[brf_chip]);
texas_load_firmware(fd, fw);

texas_change_speed(fd, speed);
--
1.7.4.4

2011-08-17 07:32:36

by Pavel Raiskup

Subject: Re: [PATCH 7/8] Possible static overrun removed

Hi Lucas,

> Hi Pavel,
>
> On Tue, Aug 16, 2011 at 6:51 AM, Pavel Raiskup <[email protected]>
> wrote:
>> There will be static overrun on c_brf_chip array when brf_chip
>> is greater than 7.
>> ---
>> tools/hciattach_tialt.c | 3 ++-
>> 1 files changed, 2 insertions(+), 1 deletions(-)
>>
>> diff --git a/tools/hciattach_tialt.c b/tools/hciattach_tialt.c
>> index 1ba009c..fc3ed20 100644
>> --- a/tools/hciattach_tialt.c
>> +++ b/tools/hciattach_tialt.c
>> @@ -234,7 +234,8 @@ int texasalt_init(int fd, int speed, struct termios
>> *ti)
>> ((brf_chip > 7) ? "unknown" :
>> c_brf_chip[brf_chip]),
>
> Did you forget the line above? There's the same problem you fixed
> below. Maybe it's better to set
> brf_chip to 0 if it's greater than 7 here.

there is check for brf_chip > 7, I think this is correct. Anyway setting
brf_chip to 0 is not kosher cause IMO this variable is got from HW and when
plotting it out (on line 235) we want to have unchanged value. When HW
gives
us weird value we want to know it.

>> brf_chip);
>>
>> - sprintf(fw, "/etc/firmware/%s.bin",
>> c_brf_chip[brf_chip]);
>> + sprintf(fw, "/etc/firmware/%s.bin",
>> + brf_chip > 7 ? "unknown" :
>> c_brf_chip[brf_chip]);
>> texas_load_firmware(fd, fw);
>>
>> texas_change_speed(fd, speed);
>> --

Pavel

2011-08-16 17:00:22

by Lucas De Marchi

Subject: Re: [PATCH 7/8] Possible static overrun removed

Hi Pavel,

On Tue, Aug 16, 2011 at 6:51 AM, Pavel Raiskup <[email protected]> wrote:
> There will be static overrun on c_brf_chip array when brf_chip
> is greater than 7.
> ---
> ?tools/hciattach_tialt.c | ? ?3 ++-
> ?1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/tools/hciattach_tialt.c b/tools/hciattach_tialt.c
> index 1ba009c..fc3ed20 100644
> --- a/tools/hciattach_tialt.c
> +++ b/tools/hciattach_tialt.c
> @@ -234,7 +234,8 @@ int texasalt_init(int fd, int speed, struct termios *ti)
> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?((brf_chip > 7) ? "unknown" :
> c_brf_chip[brf_chip]),

Did you forget the line above? There's the same problem you fixed
below. Maybe it's better to set
brf_chip to 0 if it's greater than 7 here.

> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?brf_chip);
>
> - ? ? ? ? ? ? ? sprintf(fw, "/etc/firmware/%s.bin", c_brf_chip[brf_chip]);
> + ? ? ? ? ? ? ? sprintf(fw, "/etc/firmware/%s.bin",
> + ? ? ? ? ? ? ? ? ? ? ? brf_chip > 7 ? "unknown" : c_brf_chip[brf_chip]);
> ? ? ? ? ? ? ? ?texas_load_firmware(fd, fw);
>
> ? ? ? ? ? ? ? ?texas_change_speed(fd, speed);
> --


Lucas De Marchi