Skip to content

Commit 6bfd233

Browse files
committed
dahdi-base: fix potential underflow of unsigned type
Compile fails on newer kernels due to better fortification of memcpy calls. In function 'strncat', inlined from 'dahdi_ioctl_get_version' at dahdi-linux-3.4.0/drivers/dahdi/dahdi-base.c:5405:3: ./include/linux/fortify-string.h:114:33: error: '__builtin_memcpy' accessing 4294967295 bytes at offsets [80, 238] and 0 overlaps 6442450943 bytes at offset -2147483648 [-Werror=restrict] 114 | #define __underlying_memcpy __builtin_memcpy | ^ ./include/linux/fortify-string.h:457:9: note: in expansion of macro '__underlying_memcpy' 457 | __underlying_memcpy(p + p_len, q, copy_len); | ^~~~~~~~~~~~~~~~~~~ Fix this by avoiding a potential underflow of unsigned type size_t. Signed-off-by: Daniel Golle <[email protected]>
1 parent 648016d commit 6bfd233

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

drivers/dahdi/dahdi-base.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5380,7 +5380,7 @@ static int dahdi_ioctl_get_version(unsigned long data)
53805380
{
53815381
struct dahdi_versioninfo vi;
53825382
struct ecfactory *cur;
5383-
size_t space = sizeof(vi.echo_canceller) - 1;
5383+
size_t space = sizeof(vi.echo_canceller) - 1, ec_name_len;
53845384
bool have_hwec = dahdi_any_hwec_available();
53855385

53865386
memset(&vi, 0, sizeof(vi));
@@ -5404,9 +5404,10 @@ static int dahdi_ioctl_get_version(unsigned long data)
54045404
}
54055405
strncat(vi.echo_canceller + strlen(vi.echo_canceller),
54065406
ec_name, space);
5407-
space -= strlen(ec_name);
5408-
if (space < 1)
5407+
ec_name_len = strlen(ec_name);
5408+
if (ec_name_len > space + 1)
54095409
break;
5410+
space -= ec_name_len;
54105411
if (cur->list.next && (cur->list.next != &ecfactory_list)) {
54115412
strncat(vi.echo_canceller + strlen(vi.echo_canceller),
54125413
", ", space);

0 commit comments

Comments
 (0)