From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752025AbdGRB4N (ORCPT <rfc822;w@1wt.eu>);
        Mon, 17 Jul 2017 21:56:13 -0400
Received: from out1-smtp.messagingengine.com ([66.111.4.25]:46559 "EHLO
        out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1751617AbdGRB4M (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 17 Jul 2017 21:56:12 -0400
X-ME-Sender: <xms:u2ptWbn3a9QfWJquhXN2nwGX8YF0jo_fPVmc2zsU8W62k469L68OtA>
X-Sasl-enc: 65CckNfZP281jkztpkbU3B7XaH2sd43/qnG7DGHbB/+s 1500342971
Date: Mon, 17 Jul 2017 21:56:08 -0400
From: Jacob von Chorus <jacobvonchorus@cwphoto.ca>
To: Joe Perches <joe@perches.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Insop Song <insop.song@gainspeed.com>, devel@driverdev.osuosl.org,
        linux-kernel@vger.kernel.org, dan.carpenter@oracle.com
Subject: Re: [PATCH v2 2/2] staging: gs_fpgaboot: change char to u8
Message-ID: <20170718015608.ehpguip72poza4ev@kerndev>
References: <20170718004726.17227-1-jacobvonchorus@cwphoto.ca>
 <20170718004726.17227-2-jacobvonchorus@cwphoto.ca>
 <1500340928.25934.18.camel@perches.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1500340928.25934.18.camel@perches.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Jul 17, 2017 at 06:22:08PM -0700, Joe Perches wrote:
> read_bitstream takes an int rdsize, not a u16.
> and this function will overflow tbuf if len > 64
>
> static void readinfo_bitstream(char *bitdata, char *buf, int *offset)
> {
> 	char tbuf[64];
> 	s32 len;
> 
> 	/* read section char */
> 	read_bitstream(bitdata, tbuf, offset, 1);
> 
> 	/* read length */
> 	read_bitstream(bitdata, tbuf, offset, 2);
> 
> 	len = tbuf[0] << 8 | tbuf[1];
> 
> 	read_bitstream(bitdata, buf, offset, len);
> 	buf[len] = '\0';
> }
> 
> len is up to 64k but tbuf is 64 bytes.

tbuf is used here to read a total of 3 bytes over two calls to
read_bitstream. The larger read of size, len, is stored to buf which is
MAX_STR bytes in length. 

> 	len = get_unaligned_le16(tbuf)
> 
> might be nicer than
> 
> 	len = tbuf[0] << 8 | tbuf[1];

Agreed, though it should be "get_unaligned_be16". 

Thanks.

Regards,
Jacob von Chorus