From nobody Sat Jun 20 00:57:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 257E6C433F5 for ; Fri, 25 Mar 2022 02:58:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358491AbiCYDAO (ORCPT ); Thu, 24 Mar 2022 23:00:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33720 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358663AbiCYC7k (ORCPT ); Thu, 24 Mar 2022 22:59:40 -0400 Received: from mail.meizu.com (edge07.meizu.com [112.91.151.210]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E5E3261B for ; Thu, 24 Mar 2022 19:58:02 -0700 (PDT) Received: from IT-EXMB-1-125.meizu.com (172.16.1.125) by mz-mail11.meizu.com (172.16.1.15) with Microsoft SMTP Server (TLS) id 14.3.487.0; Fri, 25 Mar 2022 10:57:55 +0800 Received: from meizu.meizu.com (172.16.137.70) by IT-EXMB-1-125.meizu.com (172.16.1.125) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.14; Fri, 25 Mar 2022 10:57:54 +0800 From: Haowen Bai To: CC: , Haowen Bai Subject: [PATCH V2] lib: 842: Fix pointer dereferenced before checking Date: Fri, 25 Mar 2022 10:57:53 +0800 Message-ID: <1648177073-20298-1-git-send-email-baihaowen@meizu.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 X-Originating-IP: [172.16.137.70] X-ClientProxiedBy: IT-EXMB-1-125.meizu.com (172.16.1.125) To IT-EXMB-1-125.meizu.com (172.16.1.125) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The pointer t is dereferencing comp_ops[c] before c is being bound checked. Fix this by assigning comp_ops[c] to t only if c is safy, otherwise just NULL. Signed-off-by: Haowen Bai --- V1->V2: fix two places that dereferenced before checking lib/842/842_compress.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c index c02baa4..0b47e8b 100644 --- a/lib/842/842_compress.c +++ b/lib/842/842_compress.c @@ -222,7 +222,7 @@ static int add_bits(struct sw842_param *p, u64 d, u8 n) static int add_template(struct sw842_param *p, u8 c) { int ret, i, b =3D 0; - u8 *t =3D comp_ops[c]; + u8 *t =3D c < OPS_MAX ? comp_ops[c] : NULL; bool inv =3D false; =20 if (c >=3D OPS_MAX) @@ -379,7 +379,7 @@ static int add_end_template(struct sw842_param *p) =20 static bool check_template(struct sw842_param *p, u8 c) { - u8 *t =3D comp_ops[c]; + u8 *t =3D c < OPS_MAX ? comp_ops[c] : NULL; int i, match, b =3D 0; =20 if (c >=3D OPS_MAX) --=20 2.7.4