Re: [PATCH][RFC] HPFS: Don't use pointer to out-of-scope array

[Jesper Juhl]

On Fri, 24 Dec 2010, Jesper Juhl wrote:

> On Fri, 24 Dec 2010, Andreas Schwab wrote:
> 
> > Jesper Juhl <jj@xxxxxxxxxxxxx> writes:
> > 
> > > Secondly I fail to see how this code inside the while loop can even work:
> > >
> > >   if (hpfs_ea_read(s, a, ano, pos + 4, ea->namelen + 1 + (ea->indirect ? 8 : 0), ex + 4))
> > >
> > > There is nothing initializing 'ex' which 'ea' points to, so 
> > > 'ea->namelen' and 'ea->indirect' are uninitialized.
> > 
> > The preceding hpfs_ea_read should do it (it reads the first 4 bytes of
> > ex which aliases ea->namelen and ea->indirect).
> > 
> How I managed to miss that I don't know, but I did and you are correct. 
> Thanks.
> 
But, this bit: "in the 'while (pos < len)' loop a local char array 'ex' is 
defined and subsequently the pointer variable 'ea' is set to point to the 
array. Inside the loop we may jump to the 'indirect' label which is 
outside the loop scope. At the 'indirect' label 'ea' (which now points 
to a array that is no longer in scope) is dereferenced - that's not good. 
The patch below addresses that problem by moving the 'ex' array out of 
the loop scope and into function scope."
I still believe to be correct and that's what the patch actually 
addresses, so can we agree that the patch makes sense and should be 
merged?

-- 
Jesper Juhl <jj@xxxxxxxxxxxxx>            http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/