]> git.sur5r.net Git - u-boot/commitdiff
net: Fix buffer overrun error in netconsole
authorJoe Hershberger <joe.hershberger@ni.com>
Wed, 30 Aug 2017 22:32:31 +0000 (17:32 -0500)
committerJoe Hershberger <joe.hershberger@ni.com>
Mon, 15 Jan 2018 18:05:14 +0000 (12:05 -0600)
Need to not access the byte after the input_buffer.

Reported-by: Coverity (CID: 144423)
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
drivers/net/netconsole.c

index e9dbedf32680ec05143e63d70cfa335261fafbf2..028fca966391c7d8b6839bdc653b0f40c7495522 100644 (file)
@@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port,
                len = sizeof(input_buffer) - input_size;
 
        end = input_offset + input_size;
-       if (end > sizeof(input_buffer))
+       if (end >= sizeof(input_buffer))
                end -= sizeof(input_buffer);
 
        chunk = len;
-       if (end + len > sizeof(input_buffer)) {
+       /* Check if packet will wrap in input_buffer */
+       if (end + len >= sizeof(input_buffer)) {
                chunk = sizeof(input_buffer) - end;
+               /* Copy the second part of the pkt to start of input_buffer */
                memcpy(input_buffer, pkt + chunk, len - chunk);
        }
+       /* Copy first (or only) part of pkt after end of current valid input*/
        memcpy(input_buffer + end, pkt, chunk);
 
        input_size += len;