aboutsummaryrefslogtreecommitdiffstats
path: root/arch/sparc/prom
diff options
context:
space:
mode:
authorChen Gang <gang.chen@asianux.com>2013-05-30 11:35:22 +0800
committerDavid S. Miller <davem@davemloft.net>2013-06-19 02:10:29 -0700
commit242ece22f0bd90e237365e51c5bd90a21693d6c3 (patch)
tree7fec0cddbb435a1df405f27f45822cef2e8c3c9d /arch/sparc/prom
parentsparc: remove inline marking of EXPORT_SYMBOL functions (diff)
downloadlinux-dev-242ece22f0bd90e237365e51c5bd90a21693d6c3.tar.xz
linux-dev-242ece22f0bd90e237365e51c5bd90a21693d6c3.zip
arch: sparc: prom: looping issue, need additional length check in the outside looping
When "cp >= barg_buf + BARG_LEN-2", it breaks internel looping 'while', but outside loop 'for' still has effect, so "*cp++ = ' '" will continue repeating which may cause memory overflow. So need additional length check for it in the outside looping. Also beautify the related code which found by "./scripts/checkpatch.pl" Signed-off-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/sparc/prom')
-rw-r--r--arch/sparc/prom/bootstr_32.c12
1 files changed, 7 insertions, 5 deletions
diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c
index f5ec32e0d419..d2b49d2365e7 100644
--- a/arch/sparc/prom/bootstr_32.c
+++ b/arch/sparc/prom/bootstr_32.c
@@ -23,23 +23,25 @@ prom_getbootargs(void)
return barg_buf;
}
- switch(prom_vers) {
+ switch (prom_vers) {
case PROM_V0:
cp = barg_buf;
/* Start from 1 and go over fd(0,0,0)kernel */
- for(iter = 1; iter < 8; iter++) {
+ for (iter = 1; iter < 8; iter++) {
arg = (*(romvec->pv_v0bootargs))->argv[iter];
if (arg == NULL)
break;
- while(*arg != 0) {
+ while (*arg != 0) {
/* Leave place for space and null. */
- if(cp >= barg_buf + BARG_LEN-2){
+ if (cp >= barg_buf + BARG_LEN - 2)
/* We might issue a warning here. */
break;
- }
*cp++ = *arg++;
}
*cp++ = ' ';
+ if (cp >= barg_buf + BARG_LEN - 1)
+ /* We might issue a warning here. */
+ break;
}
*cp = 0;
break;