You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by st...@apache.org on 2015/11/11 03:45:58 UTC
[2/3] incubator-mynewt-larva git commit: check offset on cbmem_read()
to make sure we're not reading beyond the bounds of the buffer. align
cbmem_walk() on a single line.
check offset on cbmem_read() to make sure we're not reading beyond the bounds of the buffer. align cbmem_walk() on a single line.
Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/commit/29571104
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/tree/29571104
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/diff/29571104
Branch: refs/heads/master
Commit: 29571104fbe433b1d1576995a5806805ca9ff030
Parents: 2a06140
Author: Sterling Hughes <st...@apache.org>
Authored: Tue Nov 10 18:44:52 2015 -0800
Committer: Sterling Hughes <st...@apache.org>
Committed: Tue Nov 10 18:45:26 2015 -0800
----------------------------------------------------------------------
libs/util/src/cbmem.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/blob/29571104/libs/util/src/cbmem.c
----------------------------------------------------------------------
diff --git a/libs/util/src/cbmem.c b/libs/util/src/cbmem.c
index 945270e..07968e1 100644
--- a/libs/util/src/cbmem.c
+++ b/libs/util/src/cbmem.c
@@ -215,6 +215,12 @@ cbmem_read(struct cbmem *cbmem, struct cbmem_entry_hdr *hdr, void *buf,
len = hdr->ceh_len - off;
}
+ if (off > hdr->ceh_len) {
+ rc = -1;
+ cbmem_lock_release(cbmem);
+ goto err;
+ }
+
memcpy(buf, (uint8_t *) hdr + sizeof(*hdr) + off, len);
rc = cbmem_lock_release(cbmem);
@@ -229,8 +235,7 @@ err:
int
-cbmem_walk(struct cbmem *cbmem, cbmem_walk_func_t walk_func,
- void *arg)
+cbmem_walk(struct cbmem *cbmem, cbmem_walk_func_t walk_func, void *arg)
{
struct cbmem_entry_hdr *hdr;
struct cbmem_iter iter;