Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 07:07:38PM +0800, Wenliang Fan wrote: > The checking condition in 'validateFlash2xReadWrite()' is not > sufficient. A large number invalid would cause an integer overflow and > pass the condition, which could cause further integer overflows in > 'Bcmchar.c:bcm_char_ioctl()'.

Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 06:19:56PM +0800, Wenliang Fan wrote: > The checking condition in 'validateFlash2xReadWrite()' is not > sufficient. A large number invalid would cause an integer overflow and > pass the condition, which could cause further integer overflows in > 'Bcmchar.c:bcm_char_ioctl()'.

Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 04:51:45PM +0800, Wenliang Fan wrote: > Thanks for your advice. > But the variable 'psFlash2xReadWrite->offset' in ' > *drivers/staging/bcm/nvm.c*:validateFlash2xReadWrite()' is also comes from > user space, which would cause an integer overflow in the following line: > > i

Re: [PATCH] drivers/staging/bcm: Integer overflow

2013-12-20 Thread Dan Carpenter
On Fri, Dec 20, 2013 at 03:13:16PM +0800, Wenliang Fan wrote: > The checking condition in 'validateFlash2xReadWrite()' is not sufficient. > A large number invalid would cause an integer overflow and pass > the condition, which could cause further integer overflows in > 'Bcmchar.c:bcm_char_ioctl()'.