net: Fix buffer overrun error in netconsole

Need to not access the byte after the input_buffer.

Reported-by: Coverity (CID: 144423)
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index e9dbedf32680ec05143e63d70cfa335261fafbf2..028fca966391c7d8b6839bdc653b0f40c7495522 100644 (file)
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -153,14 +153,17 @@ int nc_input_packet(uchar *pkt, struct in_addr src_ip, unsigned dest_port,
                len = sizeof(input_buffer) - input_size;
 
        end = input_offset + input_size;
-       if (end > sizeof(input_buffer))
+       if (end >= sizeof(input_buffer))
                end -= sizeof(input_buffer);
 
        chunk = len;
-       if (end + len > sizeof(input_buffer)) {
+       /* Check if packet will wrap in input_buffer */
+       if (end + len >= sizeof(input_buffer)) {
                chunk = sizeof(input_buffer) - end;
+               /* Copy the second part of the pkt to start of input_buffer */
                memcpy(input_buffer, pkt + chunk, len - chunk);
        }
+       /* Copy first (or only) part of pkt after end of current valid input*/
        memcpy(input_buffer + end, pkt, chunk);
 
        input_size += len;