From: Nikita Danilov <Nikita@Namesys.COM>
To: acc@cs.stanford.edu
Cc: mc@cs.stanford.edu, linux-kernel@vger.kernel.org
Subject: Re: [CHECKER] 74 potential buffer overruns in 2.5.33
Date: Wed, 20 Nov 2002 11:53:37 +0300 [thread overview]
Message-ID: <15835.19857.377606.242310@laputa.namesys.com> (raw)
In-Reply-To: <20021119234531.GA2723@Xenon.stanford.edu>
Andy Chou writes:
> Here are 74 out-of-bounds array accesses in Linux 2.5.33 found by the
> MC checker. This checker only considers statically allocated arrays
> with indices that can be calculated at compile time.
>
> The code fragment in each description below is incomplete; you'll need
> to look at the source in some cases to determine if the report is
> really a bug.
>
> We'd appreciate any feedback -- even if it's not a bug.
>
> -Andy Chou
>
>
> # BUGs | File Name
> 4 | /isdn/isdn_common.c
> 4 | /message/i2o_block.c
> 4 | /net/sch_gred.c
[...]
> ---------------------------------------------------------
> [BUG] Not really sure. Maybe just missing an assert?
> /home/acc/linux/2.5.33/fs/reiserfs/fix_node.c:2400:fix_nodes:
> ERROR:BUFFER:2400:2400:Array bounds error: p_s_tb->insert_size[5] indexed
> with [5]
> become the root node. */
>
> RFALSE( n_h == MAX_HEIGHT - 1,
> "PAP-8355: attempt to create too high of a
> tree");
RFALSE asserts that (n_h == MAX_HEIGHT - 1) is false. It is only
compiled conditionally, though. Hmm, and trees are rather tall than high.
>
>
> Error --->
> p_s_tb->insert_size[n_h + 1] = (DC_SIZE + KEY_SIZE) *
> (p_s_tb->blknum[n_h] - 1) + DC_SIZE;
> }
> else
> if ( n_h < MAX_HEIGHT - 1 )
Nikita.
prev parent reply other threads:[~2002-11-20 8:46 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-11-19 23:45 Andy Chou
2002-11-20 3:00 ` [PATCH] " Rik van Riel
2002-11-20 7:50 ` Jens Axboe
2002-11-20 8:53 ` Nikita Danilov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=15835.19857.377606.242310@laputa.namesys.com \
--to=nikita@namesys.com \
--cc=acc@cs.stanford.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=mc@cs.stanford.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®