Patchwork irda: small read beyond end of array in debug code

login
register
mail settings
Submitter Dan Carpenter
Date Feb. 27, 2013, 5:15 a.m.
Message ID <20130227051502.GC22703@longonot.mountain>
Download mbox | patch
Permalink /patch/223499/
State Accepted
Delegated to: David Miller
Headers show

Comments

Dan Carpenter - Feb. 27, 2013, 5:15 a.m.
charset comes from skb->data.  It's a number in the 0-255 range.
If we have debugging turned on then this could cause a read beyond
the end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - Feb. 27, 2013, 6:12 p.m.
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 27 Feb 2013 08:15:02 +0300

> charset comes from skb->data.  It's a number in the 0-255 range.
> If we have debugging turned on then this could cause a read beyond
> the end of the array.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index e71e85b..29340a9 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -495,8 +495,11 @@  static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
 /*		case CS_ISO_8859_9: */
 /*		case CS_UNICODE: */
 		default:
-			IRDA_DEBUG(0, "%s(), charset %s, not supported\n",
-				   __func__, ias_charset_types[charset]);
+			IRDA_DEBUG(0, "%s(), charset [%d] %s, not supported\n",
+				   __func__, charset,
+				   charset < ARRAY_SIZE(ias_charset_types) ?
+					ias_charset_types[charset] :
+					"(unknown)");
 
 			/* Aborting, close connection! */
 			iriap_disconnect_request(self);