{"id":807948,"url":"http://patchwork.ozlabs.org/api/patches/807948/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/patch/1504132351-26558-1-git-send-email-joe.hershberger@ni.com/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<1504132351-26558-1-git-send-email-joe.hershberger@ni.com>","list_archive_url":null,"date":"2017-08-30T22:32:31","name":"[U-Boot] net: Fix buffer overrun error in netconsole","commit_ref":"3cacc6a7722f4ba397ddbac991f6aa19645cc887","pull_url":null,"state":"accepted","archived":false,"hash":"06c7657c0a18c2d87cd1ea67cc260db67ccb8022","submitter":{"id":8809,"url":"http://patchwork.ozlabs.org/api/people/8809/?format=json","name":"Joe Hershberger","email":"joe.hershberger@ni.com"},"delegate":{"id":6337,"url":"http://patchwork.ozlabs.org/api/users/6337/?format=json","username":"jhersh","first_name":"Joe","last_name":"Hershberger","email":"joe.hershberger@gmail.com"},"mbox":"http://patchwork.ozlabs.org/project/uboot/patch/1504132351-26558-1-git-send-email-joe.hershberger@ni.com/mbox/","series":[{"id":709,"url":"http://patchwork.ozlabs.org/api/series/709/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=709","date":"2017-08-30T22:32:31","name":"[U-Boot] net: Fix buffer overrun error in netconsole","version":1,"mbox":"http://patchwork.ozlabs.org/series/709/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/807948/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/807948/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=lists.denx.de\n\t(client-ip=81.169.180.215; helo=lists.denx.de;\n\tenvelope-from=u-boot-bounces@lists.denx.de;\n\treceiver=)","Received":["from lists.denx.de (dione.denx.de [81.169.180.215])\n\tby ozlabs.org (Postfix) with ESMTP id 3xjL1P6zVNz9s7G\n\tfor ;\n\tThu, 31 Aug 2017 08:35:21 +1000 (AEST)","by lists.denx.de (Postfix, from userid 105)\n\tid B6B89C21D57; Wed, 30 Aug 2017 22:35:14 +0000 (UTC)","from lists.denx.de (localhost [IPv6:::1])\n\tby lists.denx.de (Postfix) with ESMTP id 3CDD7C21C41;\n\tWed, 30 Aug 2017 22:35:12 +0000 (UTC)","by lists.denx.de (Postfix, from userid 105)\n\tid CC6B9C21C41; Wed, 30 Aug 2017 22:35:10 +0000 (UTC)","from mx0b-00010702.pphosted.com (mx0a-00010702.pphosted.com\n\t[148.163.156.75])\n\tby lists.denx.de (Postfix) with ESMTPS id 288AFC21C27\n\tfor ; Wed, 30 Aug 2017 22:35:09 +0000 (UTC)","from pps.filterd (m0098781.ppops.net [127.0.0.1])\n\tby mx0a-00010702.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id\n\tv7UMWtwh023134; Wed, 30 Aug 2017 17:35:07 -0500","from ni.com (skprod2.natinst.com [130.164.80.23])\n\tby mx0a-00010702.pphosted.com with ESMTP id 2cmjtpyatk-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256\n\tverify=NOT); Wed, 30 Aug 2017 17:35:07 -0500","from us-aus-exhub1.ni.corp.natinst.com\n\t(us-aus-exhub1.ni.corp.natinst.com [130.164.68.41])\n\tby us-aus-skprod2.natinst.com (8.16.0.21/8.16.0.21) with ESMTPS id\n\tv7UMZ2XK010376\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); \n\tWed, 30 Aug 2017 17:35:06 -0500","from us-aus-exch3.ni.corp.natinst.com (130.164.68.13) by\n\tus-aus-exhub1.ni.corp.natinst.com (130.164.68.41) with Microsoft SMTP\n\tServer (TLS) id 15.0.1156.6; Wed, 30 Aug 2017 17:34:35 -0500","from us-aus-exhub2.ni.corp.natinst.com (130.164.68.32) by\n\tus-aus-exch3.ni.corp.natinst.com (130.164.68.13) with Microsoft SMTP\n\tServer (TLS) id 15.0.1156.6; Wed, 30 Aug 2017 17:34:35 -0500","from linux-xvxi.natinst.com (130.164.49.7) by\n\tus-aus-exhub2.ni.corp.natinst.com (130.164.68.32) with Microsoft SMTP\n\tServer\n\tid 15.0.1156.6 via Frontend Transport; Wed, 30 Aug 2017 17:34:35 -0500"],"X-Spam-Checker-Version":"SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-0.7 required=5.0 tests=RCVD_IN_DNSWL_LOW\n\tautolearn=unavailable autolearn_force=no version=3.4.0","From":"Joe Hershberger ","To":"","Date":"Wed, 30 Aug 2017 17:32:31 -0500","Message-ID":"<1504132351-26558-1-git-send-email-joe.hershberger@ni.com>","X-Mailer":"git-send-email 1.7.11.5","MIME-Version":"1.0","X-Proofpoint-Virus-Version":"vendor=fsecure engine=2.50.10432:, ,\n\tdefinitions=2017-08-30_09:, , signatures=0","X-Proofpoint-Spam-Details":"rule=outbound_policy_notspam\n\tpolicy=outbound_policy score=30\n\tpriorityscore=1501 malwarescore=0 suspectscore=4 phishscore=0\n\tbulkscore=0\n\tspamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0\n\tadultscore=0\n\tclassifier=spam adjust=30 reason=mlx scancount=1\n\tengine=8.0.1-1707230000\n\tdefinitions=main-1708300343","Cc":"Tom Rini , Joe Hershberger ","Subject":"[U-Boot] [PATCH] net: Fix buffer overrun error in netconsole","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.18","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" "},"content":"Need to not access the byte after the input_buffer.\n\nReported-by: Coverity (CID: 144423)\nSigned-off-by: Joe Hershberger \n---\n\n drivers/net/netconsole.c | 7 +++++--\n 1 file changed, 5 insertions(+), 2 deletions(-)","diff":"diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c\nindex e9dbedf..028fca9 100644\n--- a/drivers/net/netconsole.c\n+++ b/drivers/net/netconsole.c\n@@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port,\n \t\tlen = sizeof(input_buffer) - input_size;\n \n \tend = input_offset + input_size;\n-\tif (end > sizeof(input_buffer))\n+\tif (end >= sizeof(input_buffer))\n \t\tend -= sizeof(input_buffer);\n \n \tchunk = len;\n-\tif (end + len > sizeof(input_buffer)) {\n+\t/* Check if packet will wrap in input_buffer */\n+\tif (end + len >= sizeof(input_buffer)) {\n \t\tchunk = sizeof(input_buffer) - end;\n+\t\t/* Copy the second part of the pkt to start of input_buffer */\n \t\tmemcpy(input_buffer, pkt + chunk, len - chunk);\n \t}\n+\t/* Copy first (or only) part of pkt after end of current valid input*/\n \tmemcpy(input_buffer + end, pkt, chunk);\n \n \tinput_size += len;\n","prefixes":["U-Boot"]}