Attention is currently required from: Edward O'Callaghan, Angel Pons, Julius Werner.
View Change
2 comments:
File fmap.c:
Patch Set #1, Line 99: if (len == 0)
How does a length of zero cause problems? What if len is non-zero but smaller than `sizeof(struct fm […]
+1 we should simply check that the calculation below doesn't overflow.
Patch Set #1, Line 102: (off_t)(len - sizeof(struct fmap)
Hrmm, I added this cast at some point, but it doesn't seem to fix the
issue fully. In case `size_t` is smaller than `off_t`, the overflown
`size_t` (a positive number) would fit into `off_t` and not be converted
to a negative number, right?
To view, visit change 61545. To unsubscribe, or for help writing mail filters, visit settings.
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: Ifb408c55c3b69ddff453dcc704b7389298050473
Gerrit-Change-Number: 61545
Gerrit-PatchSet: 1
Gerrit-Owner: Edward O'Callaghan <quasisec@chromium.org>
Gerrit-Reviewer: Angel Pons <th3fanbus@gmail.com>
Gerrit-Reviewer: Julius Werner <jwerner@chromium.org>
Gerrit-Reviewer: Nico Huber <nico.h@gmx.de>
Gerrit-Reviewer: build bot (Jenkins) <no-reply@coreboot.org>
Gerrit-Attention: Edward O'Callaghan <quasisec@chromium.org>
Gerrit-Attention: Angel Pons <th3fanbus@gmail.com>
Gerrit-Attention: Julius Werner <jwerner@chromium.org>
Gerrit-Comment-Date: Wed, 02 Feb 2022 16:48:37 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Angel Pons <th3fanbus@gmail.com>
Gerrit-MessageType: comment