| Message ID | 20250304105741.489938-1-sughosh.ganu@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | wget: check return value of store_block() | expand |
On Tue, 4 Mar 2025 at 16:28, Sughosh Ganu <sughosh.ganu@linaro.org> wrote: > > The tcp_stream_rx() function calls store_block() to check if the > destination memory region is available for the chunk of data to be > copied to it. The store_block() function returns a negative value in > case the destination memory region is already in use. However this > return value is not checked in tcp_stream_rx(). Take the return value > of store_block() into consideration. > > Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> > --- > net/wget.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Looks like this has been fixed in master through 32a6c5eac000. Please disregard this patch. -sughosh > > diff --git a/net/wget.c b/net/wget.c > index 0b082c61947..847097a0e3e 100644 > --- a/net/wget.c > +++ b/net/wget.c > @@ -227,7 +227,8 @@ static int tcp_stream_rx(struct tcp_stream *tcp, u32 rx_offs, void *buf, int len > if ((max_rx_pos == (u32)(-1)) || (max_rx_pos < rx_offs + len - 1)) > max_rx_pos = rx_offs + len - 1; > > - store_block(buf, rx_offs - http_hdr_size, len); > + if (store_block(buf, rx_offs - http_hdr_size, len) < 0) > + return -1; > > return len; > } > -- > 2.34.1 >
diff --git a/net/wget.c b/net/wget.c index 0b082c61947..847097a0e3e 100644 --- a/net/wget.c +++ b/net/wget.c @@ -227,7 +227,8 @@ static int tcp_stream_rx(struct tcp_stream *tcp, u32 rx_offs, void *buf, int len if ((max_rx_pos == (u32)(-1)) || (max_rx_pos < rx_offs + len - 1)) max_rx_pos = rx_offs + len - 1; - store_block(buf, rx_offs - http_hdr_size, len); + if (store_block(buf, rx_offs - http_hdr_size, len) < 0) + return -1; return len; }
The tcp_stream_rx() function calls store_block() to check if the destination memory region is available for the chunk of data to be copied to it. The store_block() function returns a negative value in case the destination memory region is already in use. However this return value is not checked in tcp_stream_rx(). Take the return value of store_block() into consideration. Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> --- net/wget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)