Attachment 310760 Details for Bug 443332 – patch to fix a buffer overrun which is a potential crash source

[patch] patch to fix a buffer overrun which is a potential crash source

mkinitrd.patch (text/plain), 1.03 KB, created by Kuba Ober on 2008-07-02 05:46:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kuba Ober

Created: 2008-07-02 05:46:25 UTC

Size: 1.03 KB

patch

obsolete

>diff -ru mkinitrd-6.0.52.orig/bdevid/scsi.c mkinitrd-6.0.52/bdevid/scsi.c
>--- mkinitrd-6.0.52.orig/bdevid/scsi.c	2008-07-02 01:22:52.851256265 -0400
>+++ mkinitrd-6.0.52/bdevid/scsi.c	2008-07-02 01:40:41.244261877 -0400
>@@ -379,7 +379,7 @@
>     if (priv->unique_id_83)
>         return 0;
> 
>-    if (!(priv->unique_id_83 = calloc(page_83[3] + 1, sizeof (char))))
>+    if (!(priv->unique_id_83 = calloc(page_83[3]*2 + 1, sizeof (char))))
>         return 1;
> 
> #if 0
>@@ -391,11 +391,15 @@
>             priv->unique_id_83[j++] = hex_str[ page_83[4+i] & 0x0f];
>         }
>     }
>+#if 0
>+/* this is dead code: the loop above already checks for spaces */
>     for (j = 0, i = 0; priv->unique_id_83[j]; j++) {
>         if (priv->unique_id_83[j] != ' ')
>             priv->unique_id_83[i++] = priv->unique_id_83[j];
>     };
>+/* calloc fills memory with zero, so unique_id_83 is already zero-termianted */
>     priv->unique_id_83[i] = '\0';
>+#endif
>     priv->unique_id_83_len = strlen(priv->unique_id_83);
>     if (priv->unique_id_83_len > 1)
>         return 0;

Actions: View | Diff

Attachments on bug 443332: 303068 | 303069 | 304809 | 305423 | 310760