Re: [PATCH 14/14] drivers/tty/vt/vt.c : access out-of-bounds

[Richard Weinberger]

On Sat, Mar 14, 2015 at 1:46 PM, Ameen Ali <ameenali023@xxxxxxxxx> wrote:
> make sure that out-of-bounds never happens

Can it actually happen?
Isn't i guaranteed to be within bounds?

> Signed-off-by : Ameen Ali <AmeenAli023@xxxxxxxxx>
> ---
>  drivers/tty/vt/vt.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 6e00572..cf73e92 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1364,13 +1364,13 @@ static void csi_m(struct vc_data *vc)
>                                 i++;
>                                 if (i > vc->vc_npar)
>                                         break;
> -                               if (vc->vc_par[i] == 5 &&  /* 256 colours */
> -                                   i < vc->vc_npar) {     /* ubiquitous */
> +                               if (i < vc->vc_npar &&  /* 256 colours */
> +                                   vc->vc_par[i] == 5) {     /* ubiquitous */
>                                         i++;
>                                         rgb_foreground(vc,
>                                                 rgb_from_256(vc->vc_par[i]));
> -                               } else if (vc->vc_par[i] == 2 &&  /* 24 bit */
> -                                          i <= vc->vc_npar + 3) {/* extremely rare */
> +                               } else if (i <= vc->vc_npar + 3 &&  /* 24 bit */
> +                                          vc->vc_par[i] == 2) {/* extremely rare */
>                                         struct rgb c = {
>                                                 .r = vc->vc_par[i + 1],
>                                                 .g = vc->vc_par[i + 2],
> @@ -1387,13 +1387,13 @@ static void csi_m(struct vc_data *vc)
>                                 i++;
>                                 if (i > vc->vc_npar)
>                                         break;
> -                               if (vc->vc_par[i] == 5 &&  /* 256 colours */
> -                                   i < vc->vc_npar) {
> +                               if (i < vc->vc_npar &&  /* 256 colours */
> +                                  vc->vc_par[i] == 5) {
>                                         i++;
>                                         rgb_background(vc,
>                                                 rgb_from_256(vc->vc_par[i]));
> -                               } else if (vc->vc_par[i] == 2 && /* 24 bit */
> -                                          i <= vc->vc_npar + 3) {
> +                               } else if (i <= vc->vc_npar + 3 && /* 24 bit */
> +                                         vc->vc_par[i] == 2  ) {
>                                         struct rgb c = {
>                                                 .r = vc->vc_par[i + 1],
>                                                 .g = vc->vc_par[i + 2],
> --
> 2.1.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/



-- 
Thanks,
//richard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/