| Message ID | 20200706175712.538050-1-colin.king@canonical.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | acpi: mpst: fix potential infinite loop on 16 bit counter j | expand |
On 7/7/20 1:57 AM, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > The 16 bit loop counter j is being compared to a 32 bit upper loop > bound, there is a theoretical bug where the upper bound is more > than 65535 and the will iterate forever. Avoid this by making the > loop counter a 32 bit integer. > > Addresses-Coverity: ("Infinite loop") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > src/acpi/mpst/mpst.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/src/acpi/mpst/mpst.c b/src/acpi/mpst/mpst.c > index e9632414..4bfe3179 100644 > --- a/src/acpi/mpst/mpst.c > +++ b/src/acpi/mpst/mpst.c > @@ -47,7 +47,8 @@ static int mpst_test1(fwts_framework *fw) > bool passed = true; > uint32_t reserved; > uint32_t node_offset; > - uint16_t i, j; > + uint32_t j; > + uint16_t i; > > reserved = (uint32_t) mpst->reserved[0] + > ((uint32_t) mpst->reserved[1] << 8) + > Acked-by: Ivan Hu <ivan.hu@canonical.com>
On 2020-07-06 11:57 a.m., Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > The 16 bit loop counter j is being compared to a 32 bit upper loop > bound, there is a theoretical bug where the upper bound is more > than 65535 and the will iterate forever. Avoid this by making the > loop counter a 32 bit integer. > > Addresses-Coverity: ("Infinite loop") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > src/acpi/mpst/mpst.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/src/acpi/mpst/mpst.c b/src/acpi/mpst/mpst.c > index e9632414..4bfe3179 100644 > --- a/src/acpi/mpst/mpst.c > +++ b/src/acpi/mpst/mpst.c > @@ -47,7 +47,8 @@ static int mpst_test1(fwts_framework *fw) > bool passed = true; > uint32_t reserved; > uint32_t node_offset; > - uint16_t i, j; > + uint32_t j; > + uint16_t i; > > reserved = (uint32_t) mpst->reserved[0] + > ((uint32_t) mpst->reserved[1] << 8) + > Acked-by: Alex Hung <alex.hung@canonical.com>
diff --git a/src/acpi/mpst/mpst.c b/src/acpi/mpst/mpst.c index e9632414..4bfe3179 100644 --- a/src/acpi/mpst/mpst.c +++ b/src/acpi/mpst/mpst.c @@ -47,7 +47,8 @@ static int mpst_test1(fwts_framework *fw) bool passed = true; uint32_t reserved; uint32_t node_offset; - uint16_t i, j; + uint32_t j; + uint16_t i; reserved = (uint32_t) mpst->reserved[0] + ((uint32_t) mpst->reserved[1] << 8) +