From: Joe Hershberger Date: Wed, 30 Aug 2017 22:32:31 +0000 (-0500) Subject: net: Fix buffer overrun error in netconsole X-Git-Tag: v2018.03-rc1~175^2~19 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=3cacc6a7722f4ba397ddbac991f6aa19645cc887;p=oweals%2Fu-boot.git net: Fix buffer overrun error in netconsole Need to not access the byte after the input_buffer. Reported-by: Coverity (CID: 144423) Signed-off-by: Joe Hershberger --- diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index e9dbedf326..028fca9663 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port, len = sizeof(input_buffer) - input_size; end = input_offset + input_size; - if (end > sizeof(input_buffer)) + if (end >= sizeof(input_buffer)) end -= sizeof(input_buffer); chunk = len; - if (end + len > sizeof(input_buffer)) { + /* Check if packet will wrap in input_buffer */ + if (end + len >= sizeof(input_buffer)) { chunk = sizeof(input_buffer) - end; + /* Copy the second part of the pkt to start of input_buffer */ memcpy(input_buffer, pkt + chunk, len - chunk); } + /* Copy first (or only) part of pkt after end of current valid input*/ memcpy(input_buffer + end, pkt, chunk); input_size += len;