diff mbox

odp_packet_socket.c: Fix buffer overrun

Message ID 1410914365-32781-1-git-send-email-mike.holmes@linaro.org
State Accepted
Commit 6b757fa4aa5d322c6a8a086f9ae23a901eb0d350
Headers show

Commit Message

Mike Holmes Sept. 17, 2014, 12:39 a.m. UTC
Signed-off-by: Mike Holmes <mike.holmes@linaro.org>
---

The for loop exitis with i=50 if raw_sockets[i].fd == 0 is not hit in the loop
Guard against this correctly by replacing the spcific test for 49 with
greater than 49 which is the real error case for over running the buffer
raw_sockets[i].fd


 platform/linux-generic/odp_packet_socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Maxim Uvarov Sept. 22, 2014, 9:43 a.m. UTC | #1
Merged,
Thanks!

Maxim.

On 09/17/2014 04:39 AM, Mike Holmes wrote:
> Signed-off-by: Mike Holmes <mike.holmes@linaro.org>
> ---
>
> The for loop exitis with i=50 if raw_sockets[i].fd == 0 is not hit in the loop
> Guard against this correctly by replacing the spcific test for 49 with
> greater than 49 which is the real error case for over running the buffer
> raw_sockets[i].fd
>
>
>   platform/linux-generic/odp_packet_socket.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/platform/linux-generic/odp_packet_socket.c b/platform/linux-generic/odp_packet_socket.c
> index d1ea087..279a0cb 100644
> --- a/platform/linux-generic/odp_packet_socket.c
> +++ b/platform/linux-generic/odp_packet_socket.c
> @@ -141,7 +141,7 @@ static int add_raw_fd(const char *netdev, int fd)
>   			break;
>   	}
>   
> -	if (i == (MAX_RAW_SOCKETS_NETDEVS - 1)) {
> +	if (i > (MAX_RAW_SOCKETS_NETDEVS - 1)) {
>   		ODP_ERR("too many sockets\n");
>   		return -1;
>   	}
diff mbox

Patch

diff --git a/platform/linux-generic/odp_packet_socket.c b/platform/linux-generic/odp_packet_socket.c
index d1ea087..279a0cb 100644
--- a/platform/linux-generic/odp_packet_socket.c
+++ b/platform/linux-generic/odp_packet_socket.c
@@ -141,7 +141,7 @@  static int add_raw_fd(const char *netdev, int fd)
 			break;
 	}
 
-	if (i == (MAX_RAW_SOCKETS_NETDEVS - 1)) {
+	if (i > (MAX_RAW_SOCKETS_NETDEVS - 1)) {
 		ODP_ERR("too many sockets\n");
 		return -1;
 	}