tools: iio: iio_generic_buffer: Fix some integer type and calculation
authorChenyuan Mi <michenyuan@huawei.com>
Tue, 25 Jul 2023 09:24:07 +0000 (09:24 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Sep 2023 09:11:07 +0000 (11:11 +0200)
commit6c440fec96af102b0c0783d8ae3370636c0f6643
tree686a0ba52bec2708b0d2374cc77389728b8737fc
parent826e9c91a203a2e2d383d45a557ec0408549bfcc
tools: iio: iio_generic_buffer: Fix some integer type and calculation

[ Upstream commit 49d736313d0975ddeb156f4f59801da833f78b30 ]

In function size_from_channelarray(), the return value 'bytes' is defined
as int type. However, the calcution of 'bytes' in this function is designed
to use the unsigned int type. So it is necessary to change 'bytes' type to
unsigned int to avoid integer overflow.

The size_from_channelarray() is called in main() function, its return value
is directly multipled by 'buf_len' and then used as the malloc() parameter.
The 'buf_len' is completely controllable by user, thus a multiplication
overflow may occur here. This could allocate an unexpected small area.

Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Link: https://lore.kernel.org/r/20230725092407.62545-1-michenyuan@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
tools/iio/iio_generic_buffer.c