LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds
@ 2015-03-14 12:46 Ameen Ali
  2015-03-14 15:58 ` Richard Weinberger
  2015-03-16 14:22 ` One Thousand Gnomes
  0 siblings, 2 replies; 3+ messages in thread
From: Ameen Ali @ 2015-03-14 12:46 UTC (permalink / raw)
  To: jslaby, tiwai, joe; +Cc: linux-kernel, Ameen Ali

make sure that out-of-bounds never happens

Signed-off-by : Ameen Ali <AmeenAli023@gmail.com>
---
 drivers/tty/vt/vt.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 6e00572..cf73e92 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
 				i++;
 				if (i > vc->vc_npar)
 					break;
-				if (vc->vc_par[i] == 5 &&  /* 256 colours */
-				    i < vc->vc_npar) {     /* ubiquitous */
+				if (i < vc->vc_npar &&  /* 256 colours */
+				    vc->vc_par[i] == 5) {     /* ubiquitous */
 					i++;
 					rgb_foreground(vc,
 						rgb_from_256(vc->vc_par[i]));
-				} else if (vc->vc_par[i] == 2 &&  /* 24 bit */
-				           i <= vc->vc_npar + 3) {/* extremely rare */
+				} else if (i <= vc->vc_npar + 3 &&  /* 24 bit */
+				           vc->vc_par[i] == 2) {/* extremely rare */
 					struct rgb c = {
 						.r = vc->vc_par[i + 1],
 						.g = vc->vc_par[i + 2],
@@ -1387,13 +1387,13 @@ static void csi_m(struct vc_data *vc)
 				i++;
 				if (i > vc->vc_npar)
 					break;
-				if (vc->vc_par[i] == 5 &&  /* 256 colours */
-				    i < vc->vc_npar) {
+				if (i < vc->vc_npar &&  /* 256 colours */
+				   vc->vc_par[i] == 5) {
 					i++;
 					rgb_background(vc,
 						rgb_from_256(vc->vc_par[i]));
-				} else if (vc->vc_par[i] == 2 && /* 24 bit */
-				           i <= vc->vc_npar + 3) {
+				} else if (i <= vc->vc_npar + 3 && /* 24 bit */
+				          vc->vc_par[i] == 2  ) {
 					struct rgb c = {
 						.r = vc->vc_par[i + 1],
 						.g = vc->vc_par[i + 2],
-- 
2.1.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds
  2015-03-14 12:46 [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds Ameen Ali
@ 2015-03-14 15:58 ` Richard Weinberger
  2015-03-16 14:22 ` One Thousand Gnomes
  1 sibling, 0 replies; 3+ messages in thread
From: Richard Weinberger @ 2015-03-14 15:58 UTC (permalink / raw)
  To: Ameen Ali; +Cc: Jiri Slaby, Takashi Iwai, Joe Perches, LKML

On Sat, Mar 14, 2015 at 1:46 PM, Ameen Ali <ameenali023@gmail.com> wrote:
> make sure that out-of-bounds never happens

Can it actually happen?
Isn't i guaranteed to be within bounds?

> Signed-off-by : Ameen Ali <AmeenAli023@gmail.com>
> ---
>  drivers/tty/vt/vt.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 6e00572..cf73e92 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
>                                 i++;
>                                 if (i > vc->vc_npar)
>                                         break;
> -                               if (vc->vc_par[i] == 5 &&  /* 256 colours */
> -                                   i < vc->vc_npar) {     /* ubiquitous */
> +                               if (i < vc->vc_npar &&  /* 256 colours */
> +                                   vc->vc_par[i] == 5) {     /* ubiquitous */
>                                         i++;
>                                         rgb_foreground(vc,
>                                                 rgb_from_256(vc->vc_par[i]));
> -                               } else if (vc->vc_par[i] == 2 &&  /* 24 bit */
> -                                          i <= vc->vc_npar + 3) {/* extremely rare */
> +                               } else if (i <= vc->vc_npar + 3 &&  /* 24 bit */
> +                                          vc->vc_par[i] == 2) {/* extremely rare */
>                                         struct rgb c = {
>                                                 .r = vc->vc_par[i + 1],
>                                                 .g = vc->vc_par[i + 2],
> @@ -1387,13 +1387,13 @@ static void csi_m(struct vc_data *vc)
>                                 i++;
>                                 if (i > vc->vc_npar)
>                                         break;
> -                               if (vc->vc_par[i] == 5 &&  /* 256 colours */
> -                                   i < vc->vc_npar) {
> +                               if (i < vc->vc_npar &&  /* 256 colours */
> +                                  vc->vc_par[i] == 5) {
>                                         i++;
>                                         rgb_background(vc,
>                                                 rgb_from_256(vc->vc_par[i]));
> -                               } else if (vc->vc_par[i] == 2 && /* 24 bit */
> -                                          i <= vc->vc_npar + 3) {
> +                               } else if (i <= vc->vc_npar + 3 && /* 24 bit */
> +                                         vc->vc_par[i] == 2  ) {
>                                         struct rgb c = {
>                                                 .r = vc->vc_par[i + 1],
>                                                 .g = vc->vc_par[i + 2],
> --
> 2.1.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/



-- 
Thanks,
//richard

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds
  2015-03-14 12:46 [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds Ameen Ali
  2015-03-14 15:58 ` Richard Weinberger
@ 2015-03-16 14:22 ` One Thousand Gnomes
  1 sibling, 0 replies; 3+ messages in thread
From: One Thousand Gnomes @ 2015-03-16 14:22 UTC (permalink / raw)
  To: Ameen Ali; +Cc: jslaby, tiwai, joe, linux-kernel

On Sat, 14 Mar 2015 14:46:22 +0200
Ameen Ali <ameenali023@gmail.com> wrote:

> make sure that out-of-bounds never happens
> 
> Signed-off-by : Ameen Ali <AmeenAli023@gmail.com>
> ---
>  drivers/tty/vt/vt.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 6e00572..cf73e92 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
>  				i++;
>  				if (i > vc->vc_npar)
>  					break;

It's checked in advance    ^^^^^^^^^^^^^^^^^^^^^^^^^^


I guess whatever tool you used to verify it is concerned about the case
of i == vc->vc_npar ?

Alan

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2015-03-16 14:22 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-14 12:46 [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds Ameen Ali
2015-03-14 15:58 ` Richard Weinberger
2015-03-16 14:22 ` One Thousand Gnomes

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).