Horms wrote:
Make sure that there is at least 8 bytes available to be read,
and only read exactly 8 bytes.
Signed-off-by: Simon Horman <[EMAIL PROTECTED]>
Index: kexec-tools-testing/kexec/arch/ppc64/fs2dt.c
===================================================================
--- kexec-tools-testing.orig/kexec/arch/ppc64/fs2dt.c 2006-12-11
14:46:20.000000000 +0900
+++ kexec-tools-testing/kexec/arch/ppc64/fs2dt.c 2006-12-11
14:47:16.000000000 +0900
@@ -114,11 +114,15 @@
static void add_usable_mem_property(int fd, int len)
{
char fname[MAXPATH], *bname;
- char buf[MAXBYTES +1];
+ unsigned long long buf[2];
unsigned long ranges[2*MAX_MEMORY_RANGES];
unsigned long long base, end, loc_base, loc_end;
int range, rlen = 0;
+ if (len < 2 * sizeof(unsigned long long))
+ die("unrecoverable error: not enough data for mem property\n");
+ len = 2 * sizeof(unsigned long long);
+
Hmm. I think this is not the correct place to have this check.
variable len can take values anywhere from 4 to 80. With this
patch applied the kexec tools fails to load the panic kernel.
old:/home/sachin/b # /tmp/run1
get memory ranges:1
Modified cmdline:root=/dev/sda3 diag elfcorehdr=39100K savemaxmem=3840M
unrecoverable error: not enough data for mem property
old:/home/sachin/b #
The correct place should be after the strncmp() call.
Something like the attached patch.
Thanks
-Sachin
diff -Naurp b/kexec/arch/ppc64/fs2dt.c a/kexec/arch/ppc64/fs2dt.c
--- b/kexec/arch/ppc64/fs2dt.c 2006-12-11 06:47:36.000000000 -0600
+++ a/kexec/arch/ppc64/fs2dt.c 2006-12-11 06:51:20.000000000 -0600
@@ -108,7 +108,7 @@ static unsigned propnum(const char *name
static void add_usable_mem_property(int fd, int len)
{
char fname[MAXPATH], *bname;
- char buf[MAXBYTES +1];
+ unsigned long long buf[2];
unsigned long ranges[2*MAX_MEMORY_RANGES];
unsigned long long base, end, loc_base, loc_end;
int range, rlen = 0;
@@ -120,6 +120,10 @@ static void add_usable_mem_property(int
if (strncmp(bname, "/memory@", 8))
return;
+ if (len < 2 * sizeof(unsigned long long))
+ die("unrecoverable error: not enough data for mem property\n");
+ len = 2 * sizeof(unsigned long long);
+
if (lseek(fd, 0, SEEK_SET) < 0)
die("unrecoverable error: error seeking in \"%s\": %s\n",
pathname, strerror(errno));
_______________________________________________
fastboot mailing list
[email protected]
https://lists.osdl.org/mailman/listinfo/fastboot
