| Summary: |
adcli: technically wrong length checks in binary parsers |
| Product: |
realmd
|
Reporter: |
Florian Weimer <fweimer> |
| Component: |
adcli | Assignee: |
Stef Walter <stefw> |
| Status: |
RESOLVED
FIXED
|
QA Contact: |
|
| Severity: |
normal
|
|
|
| Priority: |
medium
|
CC: |
sbose, stefw
|
| Version: |
unspecified | |
|
| Hardware: |
Other | |
|
| OS: |
All | |
|
| Whiteboard: |
|
|
i915 platform:
|
|
i915 features:
|
|
|---|
| Attachments: |
Fix for the buffer length checks
|
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
library/addisco.c has several comparison like the check in this function: static unsigned short get_16 (unsigned char **p, unsigned char *end) { unsigned short val; if ((*p) + 2 > end) return 0; val = ns_get16 (*p); (*p) += 2; return val; } The problem is that a pointer that points after the element after the last element in the buffer is invalid. Depending on how this function is call, a smart compiler could optimize away such checks. The comparison should be written like this: if (end - (*p) < 2)