Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 26 May 2015 16:32:21 +0300
From: Dan Carpenter <>
To: "Jason A. Donenfeld" <>,
        Shigekatsu Tateno <>
Cc: oss-security <>,,
        Greg Kroah-Hartman <>,
Subject: Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow

On Tue, May 26, 2015 at 02:17:46PM +0200, Jason A. Donenfeld wrote:
> +			data_len = elt->length -
>  					sizeof(struct oz_get_desc_rsp) + 1;

This was in the original code, but I wonder where the + 1 comes from.
Does anyone know?

To be honest, I would prefer if we just checked:

	if (elt->length < sizeof(struct oz_get_desc_rsp) + 1)
	data_len = elt->length - sizeof(struct oz_get_desc_rsp) + 1;

Shouldn't there be an upper bound on length?  Shigekatsu?

dan carpenter

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.