From 3cacc6a7722f4ba397ddbac991f6aa19645cc887 Mon Sep 17 00:00:00 2001 From: Joe Hershberger Date: Wed, 30 Aug 2017 17:32:31 -0500 Subject: [PATCH] net: Fix buffer overrun error in netconsole Need to not access the byte after the input_buffer. Reported-by: Coverity (CID: 144423) Signed-off-by: Joe Hershberger --- drivers/net/netconsole.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index e9dbedf..028fca9 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port, len = sizeof(input_buffer) - input_size; end = input_offset + input_size; - if (end > sizeof(input_buffer)) + if (end >= sizeof(input_buffer)) end -= sizeof(input_buffer); chunk = len; - if (end + len > sizeof(input_buffer)) { + /* Check if packet will wrap in input_buffer */ + if (end + len >= sizeof(input_buffer)) { chunk = sizeof(input_buffer) - end; + /* Copy the second part of the pkt to start of input_buffer */ memcpy(input_buffer, pkt + chunk, len - chunk); } + /* Copy first (or only) part of pkt after end of current valid input*/ memcpy(input_buffer + end, pkt, chunk); input_size += len; -- 2.7.4