On 07/11/2013 04:42 AM, David Miller wrote:
> From: Chen Gang
> Date: Sat, 22 Jun 2013 13:26:09 +0800
>
>> >
>> > For the related next strcpy(), the destination length is less than 512,
>> > but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
>> > more than 512.
>> >
>> > One
From: Chen Gang
Date: Sat, 22 Jun 2013 13:26:09 +0800
>
> For the related next strcpy(), the destination length is less than 512,
> but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
> more than 512.
>
> One work flow may:
> openprom_sunos_ioctl() -> if (cmd == OPROMSETOPT
For the related next strcpy(), the destination length is less than 512,
but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
more than 512.
One work flow may:
openprom_sunos_ioctl() -> if (cmd == OPROMSETOPT)
getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
3 matches
Mail list logo