diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2011-10-03 14:36:46 +0400 |
|---|---|---|
| committer | Felix Fietkau <nbd@openwrt.org> | 2011-10-03 14:36:46 +0400 |
| commit | 591a1e349f94a4a69dea0c0bb04919a41367c009 (patch) | |
| tree | 16c1819d2c14eba90517f7883c3c7f40bb6ad979 /blob.h | |
| parent | 8cada85b610b40a8c25477985ff5c1d26ef452d0 (diff) | |
fix reads beyond the end of the buffer when iterating over blob attributes
Diffstat (limited to 'blob.h')
| -rw-r--r-- | blob.h | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -258,14 +258,14 @@ blob_put_int64(struct blob_buf *buf, int id, uint64_t val) #define __blob_for_each_attr(pos, attr, rem) \ for (pos = (void *) attr; \ - (blob_pad_len(pos) <= rem) && \ + rem > 0 && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) #define blob_for_each_attr(pos, attr, rem) \ for (rem = blob_len(attr), pos = blob_data(attr); \ - (blob_pad_len(pos) <= rem) && \ + rem > 0 && (blob_pad_len(pos) <= rem) && \ (blob_pad_len(pos) >= sizeof(struct blob_attr)); \ rem -= blob_pad_len(pos), pos = blob_next(pos)) |