| commit | 42cb108c5b7900aa687f427ea7fc99a488936e04 | |
| author | Dan Carpenter <error27@gmail.com> | |
| Fri, 24 Feb 2023 15:40:24 +0000 (24 18:40 +0300) | ||
| committer | Dan Carpenter <error27@gmail.com> | |
| Fri, 24 Feb 2023 15:40:24 +0000 (24 18:40 +0300) | ||
| tree | 43804c845d08c01f8a2d470489794c9e271f330e | treesnapshot (tar.gz zip) |
| parent | 1571fefbd71f4f75d05de1a21deaa484e2a6d4c8 | commitdiff |
points_to_user_data: handle some pointer math better
In this case the bug was we have a buffer "req" that comes from the
user and but we want an offset into the buffer like this:
p = ((char *)&req->hdr.ProtocolId + offset);
It should get the state of "req" but instead it was looking for the state
of "&req->hdr.ProtocolId" and that doesn't have a state.
Signed-off-by: Dan Carpenter <error27@gmail.com>
In this case the bug was we have a buffer "req" that comes from the
user and but we want an offset into the buffer like this:
p = ((char *)&req->hdr.ProtocolId + offset);
It should get the state of "req" but instead it was looking for the state
of "&req->hdr.ProtocolId" and that doesn't have a state.
Signed-off-by: Dan Carpenter <error27@gmail.com>
| smatch_points_to_user_data.c | diffblobblamehistory |