Skip to content

Commit

Permalink
ieee1394: nodemgr: check info_length in ROM header earlier
Browse files Browse the repository at this point in the history
The whole ROM area which is covered by the crc_length field of the ROM
header was fetched before the info_length field was checked for correct
general ROM format.  This might be wasteful or even dangerous with nodes
with minimal ROM, nonstandard ROM, or corrupt ROM.

Perform this check at the earliest opportunity.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
  • Loading branch information
Stefan Richter committed Feb 8, 2007
1 parent e658bc5 commit b2051f8
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions drivers/ieee1394/csr1212.c
Original file line number Diff line number Diff line change
Expand Up @@ -1234,6 +1234,12 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
csr->private);
if (ret != CSR1212_SUCCESS)
return ret;

/* check ROM header's info_length */
if (i == 0 &&
CSR1212_BE32_TO_CPU(csr->cache_head->data[0]) >> 24 !=
bytes_to_quads(csr->bus_info_len) - 1)
return CSR1212_EINVAL;
}

bi = (struct csr1212_bus_info_block_img*)csr->cache_head->data;
Expand All @@ -1250,9 +1256,6 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
return ret;
}

if (bytes_to_quads(csr->bus_info_len - sizeof(csr1212_quad_t)) != bi->length)
return CSR1212_EINVAL;

#if 0
/* Apparently there are too many differnt wrong implementations of the
* CRC algorithm that verifying them is moot. */
Expand Down

0 comments on commit b2051f8

Please sign in to comment.