Jaroslav Beran 7c96a25ec1 can: prevent integer overflow in can_write ... Because buflen is size_t (unsigned) and nsent is ssize_t (signed) of the same size, (buflen - nsent) results in unsigned and overflows if nsent > buflen. This happens when sending CAN FD frame with DLC > 8 and a user gets the buflen parameter as a result of CAN_MSGLEN(len) where `len' is the size of data which is less then a size for some extended DLC (e.g. 26 bytes is sent in a message with DLC 0xD, which has 32 bytes of data). The correct buflen value should be rather CAN_MSGLEN(can_dlc2bytes(can_bytes2dlc(len))) Signed-off-by: Jaroslav Beran <jara.beran@gmail.com>		2021-03-19 23:00:07 -07:00
..
Kconfig	style/Kconfig: remove unnecessary trailing whitespace	2020-11-28 12:20:30 +01:00
Make.defs	drivers: Author Gregory Nutt: update licenses to Apache	2021-03-04 18:32:27 -08:00
can.c	can: prevent integer overflow in can_write	2021-03-19 23:00:07 -07:00
mcp2515.c	drivers/can/mcp2515.c: Fix a syslog format	2020-11-28 23:14:05 -06:00
mcp2515.h	drivers: Alan Carvalho de Assis: update licenses to Apache	2021-03-13 05:56:43 -08:00