Need to not access the byte after the input_buffer.
Reported-by: Coverity (CID: 144423) Signed-off-by: Joe Hershberger joe.hershberger@ni.com ---
drivers/net/netconsole.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index e9dbedf..028fca9 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port, len = sizeof(input_buffer) - input_size;
end = input_offset + input_size; - if (end > sizeof(input_buffer)) + if (end >= sizeof(input_buffer)) end -= sizeof(input_buffer);
chunk = len; - if (end + len > sizeof(input_buffer)) { + /* Check if packet will wrap in input_buffer */ + if (end + len >= sizeof(input_buffer)) { chunk = sizeof(input_buffer) - end; + /* Copy the second part of the pkt to start of input_buffer */ memcpy(input_buffer, pkt + chunk, len - chunk); } + /* Copy first (or only) part of pkt after end of current valid input*/ memcpy(input_buffer + end, pkt, chunk);
input_size += len;