[lkml]   [2019]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] time: compat settimeofday: Validate the values of tv from user
On 2019/7/5 20:14, Thomas Gleixner wrote:
> Zhengbin,
> On Fri, 5 Jul 2019, zhengbin wrote:
>> Similar to commit 6ada1fc0e1c4
>> ("time: settimeofday: Validate the values of tv from user"),
>> an unvalidated user input is multiplied by a constant, which can result
>> in an undefined behaviour for large values. While this is validated
>> later, we should avoid triggering undefined behaviour.
> I surely agree with the patch, but the argument that this is validated
> later and we just should avoid UB in general is just wrong.
> For a wide range of negative tv_usec values the multiplication overflow
> turns them in positive numbers. So the 'validated later' is not catching
> the invalid input.
> So 'should avoid ....' is just the wrong argument here.
> Validation _is_ required before the multiplication so UB won't turn an
> invalid value into a valid one.
> Thanks,
> tglx
Strongly agree with this, I send a v2 patch, modify the comment?
> .

 \ /
  Last update: 2019-07-05 14:33    [W:0.055 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site