From patchwork Wed Nov 3 08:27:25 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brian Norris X-Patchwork-Id: 69951 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from canuck.infradead.org (canuck.infradead.org [134.117.69.58]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 70479B70AF for ; Wed, 3 Nov 2010 19:34:33 +1100 (EST) Received: from localhost ([127.0.0.1] helo=canuck.infradead.org) by canuck.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux)) id 1PDYkV-0007tE-5h; Wed, 03 Nov 2010 08:31:15 +0000 Received: from mms3.broadcom.com ([216.31.210.19]) by canuck.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux)) id 1PDYk0-0007nI-AJ for linux-mtd@lists.infradead.org; Wed, 03 Nov 2010 08:30:45 +0000 Received: from [10.9.200.131] by MMS3.broadcom.com with ESMTP (Broadcom SMTP Relay (Email Firewall v6.3.2)); Wed, 03 Nov 2010 01:30:29 -0700 X-Server-Uuid: B55A25B1-5D7D-41F8-BC53-C57E7AD3C201 Received: from mail-irva-12.broadcom.com (10.11.16.101) by IRVEXCHHUB01.corp.ad.broadcom.com (10.9.200.131) with Microsoft SMTP Server id 8.2.247.2; Wed, 3 Nov 2010 01:30:29 -0700 Received: from localhost.localdomain (ld-irv-0074.broadcom.com [10.12.160.50]) by mail-irva-12.broadcom.com (Postfix) with ESMTP id DB1D269CF6; Wed, 3 Nov 2010 01:30:14 -0700 (PDT) From: "Brian Norris" To: linux-mtd@lists.infradead.org Subject: [PATCH 08/10] mtd-utils: nandwrite: prevent 32-bit overflow Date: Wed, 3 Nov 2010 01:27:25 -0700 Message-ID: <1288772847-8120-8-git-send-email-computersforpeace@gmail.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1288772847-8120-1-git-send-email-computersforpeace@gmail.com> References: <1288772847-8120-1-git-send-email-computersforpeace@gmail.com> MIME-Version: 1.0 X-WSS-ID: 60CFC22F3HC1222833-01-01 X-CRM114-Version: 20090807-BlameThorstenAndJenny ( TRE 0.7.6 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20101103_043044_760590_3FD506BC X-CRM114-Status: GOOD ( 12.93 ) X-Spam-Score: 1.2 (+) X-Spam-Report: SpamAssassin version 3.3.1 on canuck.infradead.org summary: Content analysis details: (1.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is freemail (computersforpeace[at]gmail.com) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL Cc: Brian Norris , Jehan Bing , David Woodhouse , Mike Frysinger , Artem Bityutskiy X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org For large block- and page-sizes, the multiplication of ebsize_aligned and pagelen can overflow a 32-bit integer. This overflow can be prevented by a simple change in order of operations (i.e., do division first). Since ebsize_aligned is always a multiple of mtd.min_io_size, this produces no change in results. Signed-off-by: Brian Norris --- nandwrite.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/nandwrite.c b/nandwrite.c index 8ec5afe..364acdf 100644 --- a/nandwrite.c +++ b/nandwrite.c @@ -441,7 +441,7 @@ int main(int argc, char * const argv[]) } // Allocate a buffer big enough to contain all the data (OOB included) for one eraseblock - filebuf_max = pagelen * ebsize_aligned / mtd.min_io_size; + filebuf_max = ebsize_aligned / mtd.min_io_size * pagelen; filebuf = xmalloc(filebuf_max); erase_buffer(filebuf, filebuf_max);