korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 12:28:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

tools: iio: iio_generic_buffer: Fix some integer type and calculation

Browse Source 
In function size_from_channelarray(), the return value 'bytes' is defined
as int type. However, the calcution of 'bytes' in this function is designed
to use the unsigned int type. So it is necessary to change 'bytes' type to
unsigned int to avoid integer overflow.

The size_from_channelarray() is called in main() function, its return value
is directly multipled by 'buf_len' and then used as the malloc() parameter.
The 'buf_len' is completely controllable by user, thus a multiplication
overflow may occur here. This could allocate an unexpected small area.

Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Link: https://lore.kernel.org/r/20230725092407.62545-1-michenyuan@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
This commit is contained in:
Chenyuan Mi 2023-07-25 09:24:07 +00:00 committed by Jonathan Cameron
parent 9afc8c6dc6
commit 49d736313d
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
tools/iio/iio_generic_buffer.c
View File

@ -51,9 +51,9 @@ enum autochan {
* Has the side effect of filling the channels[i].location values used
* in processing the buffer output.
**/
static int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
{
int bytes = 0;
unsigned int bytes = 0;
int i = 0;
while (i < num_channels) {
@ -348,7 +348,7 @@ int main(int argc, char **argv)
ssize_t read_size;
int dev_num = -1, trig_num = -1;
char *buffer_access = NULL;
int scan_size;
unsigned int scan_size;
int noevents = 0;
int notrigger = 0;
char *dummy;
@ -674,7 +674,16 @@ int main(int argc, char **argv)
}
scan_size = size_from_channelarray(channels, num_channels);
data = malloc(scan_size * buf_len);
size_t total_buf_len = scan_size * buf_len;
if (scan_size > 0 && total_buf_len / scan_size != buf_len) {
ret = -EFAULT;
perror("Integer overflow happened when calculate scan_size * buf_len");
goto error;
}
data = malloc(total_buf_len);
if (!data) {
ret = -ENOMEM;
goto error;