| Submitter | roel kluin |
|---|---|
| Date | March 1, 2009, 9:09 p.m. |
| Message ID | <49AAF989.8070000@gmail.com> |
| Download | mbox | patch |
| Permalink | /patch/23916/ |
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
Comments
Roel Kluin <roel.kluin@gmail.com> wrote: > > diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c > index 25524d4..0b9d63f 100644 > --- a/net/ipv4/tcp_probe.c > +++ b/net/ipv4/tcp_probe.c > @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf, > { > int error = 0, cnt = 0; > > - if (!buf || len < 0) > + if (!buf || (ssize_t)len < 0) > return -EINVAL; > > while (cnt < len) { Either cnt needs to be promoted, or you need to limit len to INT_MAX. Cheers,
From: Herbert Xu <herbert@gondor.apana.org.au> Date: Mon, 2 Mar 2009 12:30:56 +0800 > Roel Kluin <roel.kluin@gmail.com> wrote: > > > > diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c > > index 25524d4..0b9d63f 100644 > > --- a/net/ipv4/tcp_probe.c > > +++ b/net/ipv4/tcp_probe.c > > @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf, > > { > > int error = 0, cnt = 0; > > > > - if (!buf || len < 0) > > + if (!buf || (ssize_t)len < 0) > > return -EINVAL; > > > > while (cnt < len) { > > Either cnt needs to be promoted, or you need to limit len to INT_MAX. Right, since the positive range of 'size_t' can exceed that of 'int' -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Patch
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c index 25524d4..0b9d63f 100644 --- a/net/ipv4/tcp_probe.c +++ b/net/ipv4/tcp_probe.c @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf, { int error = 0, cnt = 0; - if (!buf || len < 0) + if (!buf || (ssize_t)len < 0) return -EINVAL; while (cnt < len) {
or should this be fixed, with if (!buf || len > x) if so, what should x be? This patch wasn't tested in any way. ------------------------------>8-------------8<--------------------------------- len is unsigned, so the '< 0' test won't work. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> --- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html