diff options
author | Felix Fietkau <nbd@openwrt.org> | 2011-10-03 14:36:46 +0400 |
---|---|---|
committer | Felix Fietkau <nbd@openwrt.org> | 2011-10-03 14:36:46 +0400 |
commit | 591a1e349f94a4a69dea0c0bb04919a41367c009 (patch) | |
tree | 16c1819d2c14eba90517f7883c3c7f40bb6ad979 | |
parent | 8cada85b610b40a8c25477985ff5c1d26ef452d0 (diff) |
fix reads beyond the end of the buffer when iterating over blob attributes
-rw-r--r-- | blob.h | 4 | ||||
-rw-r--r-- | blobmsg.h | 2 |
2 files changed, 3 insertions, 3 deletions
@@ -258,14 +258,14 @@ blob_put_int64(struct blob_buf *buf, int id, uint64_t val) #define __blob_for_each_attr(pos, attr, rem) \ for (pos = (void *) attr; \ - (blob_pad_len(pos) <= rem) && \ + rem > 0 && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) #define blob_for_each_attr(pos, attr, rem) \ for (rem = blob_len(attr), pos = blob_data(attr); \ - (blob_pad_len(pos) <= rem) && \ + rem > 0 && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) @@ -177,7 +177,7 @@ void blobmsg_add_string_buffer(struct blob_buf *buf); #define blobmsg_for_each_attr(pos, attr, rem) \ for (rem = blobmsg_data_len(attr), pos = blobmsg_data(attr); \ - (blob_pad_len(pos) <= rem) && \ + rem > 0 && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) |