Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 458350

Summary: fs/cifs/asn1.c:403: warning: comparison is always false due to limited range of data type
Product: Red Hat Enterprise MRG Reporter: Luis Claudio R. Goncalves <lgoncalv>
Component: realtime-kernelAssignee: Eugene Teo (Security Response) <eteo>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 1.0CC: bhu, davids, eteo, williams
Target Milestone: 1.0.3   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-10-07 19:20:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed backported patch
none
Proposed backported patch none

Description Luis Claudio R. Goncalves 2008-08-07 18:38:49 UTC
Description of problem:

From fs/cifs/asn1.c line 403:
...
unsigned int size;
...
if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
                 return 0;
...

That lead to:

1. Second half of comparison is always false, so the upper limit is not really tested and

2. This compile time warning:
fs/cifs/asn1.c:403: warning: comparison is always false due to limited range of data type

Version-Release number of selected component (if applicable):

Observed in 2.6.24.7-75.el5rt

Comment 1 Eugene Teo (Security Response) 2008-08-07 23:44:45 UTC
It should be:
if (size < 2 || size > UINT_MAX/sizeof(unsigned long))
                 return 0;

Upstream commit: 04e1e0cccade330ab3715ce59234f7e3b087e246

Comment 2 Eugene Teo (Security Response) 2008-08-08 00:29:07 UTC
[20:26] (__lc) <__lc> net/ipv4/netfilter/nf_nat_snmp_basic.c:447: warning: 
               comparison is always false due to limited range of data type
[20:27] (__lc) hey, the very same code:
[20:27] (__lc)         if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))

We need this included. Looks like it's not patched in upstream, so I'm sending a patch there too.

Comment 4 Eugene Teo (Security Response) 2008-08-08 00:45:11 UTC
(In reply to comment #2)
> [20:26] (__lc) <__lc> net/ipv4/netfilter/nf_nat_snmp_basic.c:447: warning: 
>                comparison is always false due to limited range of data type
> [20:27] (__lc) hey, the very same code:
> [20:27] (__lc)         if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
> 
> We need this included. Looks like it's not patched in upstream, so I'm sending
> a patch there too.

Jan Beulich submitted it, so it's in a queue now.

Comment 5 Eugene Teo (Security Response) 2008-08-08 05:05:28 UTC
Created attachment 313781 [details]
Proposed backported patch

Comment 8 Eugene Teo (Security Response) 2008-08-17 01:26:38 UTC
(In reply to comment #4)
> (In reply to comment #2)
> > [20:26] (__lc) <__lc> net/ipv4/netfilter/nf_nat_snmp_basic.c:447: warning: 
> >                comparison is always false due to limited range of data type
> > [20:27] (__lc) hey, the very same code:
> > [20:27] (__lc)         if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
> > 
> > We need this included. Looks like it's not patched in upstream, so I'm sending
> > a patch there too.
> 
> Jan Beulich submitted it, so it's in a queue now.

Luis, so, the upstream took David's patch instead. So the fix for above is slightly different. Please see 252815b0cfe711001eff0327872209986b36d490.

Also, just for reference, the upstream commit for fs/cifs/asn1.c warning is 04e1e0cccade330ab3715ce59234f7e3b087e246.

Thanks.

Comment 9 Eugene Teo (Security Response) 2008-08-17 03:28:28 UTC
Created attachment 314438 [details]
Proposed backported patch

Comment 10 Luis Claudio R. Goncalves 2008-09-09 21:57:10 UTC
Added a patch to -79 to keep us in sync with upstream...

Comment 16 errata-xmlrpc 2008-10-07 19:20:34 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2008-0857.html