diff options
| author | Chen Gang <gang.chen@asianux.com> | 2013-05-30 07:35:22 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-06-19 13:10:29 +0400 |
| commit | 242ece22f0bd90e237365e51c5bd90a21693d6c3 (patch) | |
| tree | 7fec0cddbb435a1df405f27f45822cef2e8c3c9d /arch/sparc | |
| parent | dbebe0da64d0738a21221a7f9d29510b9f29d908 (diff) | |
| download | linux-242ece22f0bd90e237365e51c5bd90a21693d6c3.tar.xz | |
arch: sparc: prom: looping issue, need additional length check in the outside looping
When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while',
but outside loop 'for' still has effect, so "*cp++ = ' '" will continue
repeating which may cause memory overflow.
So need additional length check for it in the outside looping.
Also beautify the related code which found by "./scripts/checkpatch.pl"
Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/sparc')
| -rw-r--r-- | arch/sparc/prom/bootstr_32.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c index f5ec32e0d419..d2b49d2365e7 100644 --- a/arch/sparc/prom/bootstr_32.c +++ b/arch/sparc/prom/bootstr_32.c @@ -23,23 +23,25 @@ prom_getbootargs(void) return barg_buf; } - switch(prom_vers) { + switch (prom_vers) { case PROM_V0: cp = barg_buf; /* Start from 1 and go over fd(0,0,0)kernel */ - for(iter = 1; iter < 8; iter++) { + for (iter = 1; iter < 8; iter++) { arg = (*(romvec->pv_v0bootargs))->argv[iter]; if (arg == NULL) break; - while(*arg != 0) { + while (*arg != 0) { /* Leave place for space and null. */ - if(cp >= barg_buf + BARG_LEN-2){ + if (cp >= barg_buf + BARG_LEN - 2) /* We might issue a warning here. */ break; - } *cp++ = *arg++; } *cp++ = ' '; + if (cp >= barg_buf + BARG_LEN - 1) + /* We might issue a warning here. */ + break; } *cp = 0; break; |