diff mbox series

[U-Boot] net: Fix buffer overrun error in netconsole

Message ID 1504132351-26558-1-git-send-email-joe.hershberger@ni.com
State Accepted
Commit 3cacc6a7722f4ba397ddbac991f6aa19645cc887
Delegated to: Joe Hershberger
Headers show
Series [U-Boot] net: Fix buffer overrun error in netconsole | expand

Commit Message

Joe Hershberger Aug. 30, 2017, 10:32 p.m. UTC 
Need to not access the byte after the input_buffer.

Reported-by: Coverity (CID: 144423)
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
---

 drivers/net/netconsole.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Joe Hershberger Jan. 22, 2018, 4:48 p.m. UTC | #1 
Hi Joe,

https://patchwork.ozlabs.org/patch/807948/ was applied to http://git.denx.de/?p=u-boot/u-boot-net.git

Thanks!
-Joe
diff mbox series

Patch

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index e9dbedf..028fca9 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -153,14 +153,17 @@  int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port,
 		len = sizeof(input_buffer) - input_size;
 
 	end = input_offset + input_size;
-	if (end > sizeof(input_buffer))
+	if (end >= sizeof(input_buffer))
 		end -= sizeof(input_buffer);
 
 	chunk = len;
-	if (end + len > sizeof(input_buffer)) {
+	/* Check if packet will wrap in input_buffer */
+	if (end + len >= sizeof(input_buffer)) {
 		chunk = sizeof(input_buffer) - end;
+		/* Copy the second part of the pkt to start of input_buffer */
 		memcpy(input_buffer, pkt + chunk, len - chunk);
 	}
+	/* Copy first (or only) part of pkt after end of current valid input*/
 	memcpy(input_buffer + end, pkt, chunk);
 
 	input_size += len;