[PATCH 1/4] ozwpan: Use proper check to prevent heap overflow

[Jason A. Donenfeld]

On May 15, 2015 4:10 PM, "David Laight" <David.Laight at aculab.com> wrote:
> Why not just check the length. eg:
>                         unsigned int data_len = elt->length;
>                         if (data_len < sizeof(struct oz_get_desc_rsp) + 1)
>                                 break;

Sure.

> >                       u16 offs = le16_to_cpu(get_unaligned(&body->offset));
> >                       u16 total_size =
> >                               le16_to_cpu(get_unaligned(&body->total_size));
>
> Don't put variable definitions after code.
>
> You don't really want to do arithmetic on local variables that are
> smaller than a machine word (eg u8 and u16), doing so can require
> the compiler generate a lot more code.

This is code is just part of the patch context. Care to submit a
follow up patch fixing this so the maintainer can incorporate it? FYI,
this is a common occurrence throughout the driver, and a patch set
should probably be posted that systematically fixes this problem.