Re: [patch] mptfusion: prevent some memory corruption

2015-08-21 Thread Dan Carpenter
Ping? regards, dan carpenter On Fri, Jul 03, 2015 at 11:53:03AM +0300, Dan Carpenter wrote: > These are signed values the come from the user, we put a cap on the > upper bounds but not on the lower bounds. > > We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and > proceed as if tha

Re: [patch] mptfusion: prevent some memory corruption

2015-07-03 Thread Johannes Thumshirn
Dan Carpenter writes: > These are signed values the come from the user, we put a cap on the > upper bounds but not on the lower bounds. > > We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and > proceed as if that means that "karg.dataSgeOffset" is correct but this > fails to consid

[patch] mptfusion: prevent some memory corruption

2015-07-03 Thread Dan Carpenter
These are signed values the come from the user, we put a cap on the upper bounds but not on the lower bounds. We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and proceed as if that means that "karg.dataSgeOffset" is correct but this fails to consider that the "sz" calculations can h