From 54d612f78a417090bc0449658426d9180b84b2e9 Mon Sep 17 00:00:00 2001
From: Jijie Shao <shaojijie@huawei.com>
Date: Wed, 14 Aug 2024 16:16:57 +0800
Subject: [PATCH 10/27] hikptool: nic: Fix the Code review comments in NIC
 modules

Fix issue of Out-of-bounds access may occur.

Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 net/nic/nic_dfx/hikp_nic_dfx.c  | 20 +++++++++++++++++++-
 net/nic/nic_mac/hikp_nic_port.c |  7 +++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/net/nic/nic_dfx/hikp_nic_dfx.c b/net/nic/nic_dfx/hikp_nic_dfx.c
index 4095229..2cc4367 100644
--- a/net/nic/nic_dfx/hikp_nic_dfx.c
+++ b/net/nic/nic_dfx/hikp_nic_dfx.c
@@ -21,6 +21,9 @@
 #include "hikp_net_lib.h"
 #include "hikp_nic_dfx.h"
 
+#define dfx_get_max_reg_bffer_size(rsp_head) \
+	(uint32_t)((rsp_head)->total_blk_num * MAX_DFX_DATA_NUM * sizeof(uint32_t))
+
 struct nic_dfx_param g_dfx_param = { 0 };
 
 static const struct dfx_module_cmd g_dfx_module_parse[] = {
@@ -138,7 +141,7 @@ static int hikp_nic_get_first_blk_dfx(struct nic_dfx_rsp_head_t *rsp_head, uint3
 		rsp_head->total_type_num = 0;
 		goto err_out;
 	}
-	*max_dfx_size = (uint32_t)(rsp_head->total_blk_num * MAX_DFX_DATA_NUM * sizeof(uint32_t));
+	*max_dfx_size = dfx_get_max_reg_bffer_size(rsp_head);
 	*reg_data = (uint32_t *)calloc(1, *max_dfx_size);
 	if (*reg_data == NULL) {
 		HIKP_ERROR_PRINT("malloc log memory 0x%x failed.\n", *max_dfx_size);
@@ -284,8 +287,23 @@ static void hikp_nic_dfx_print(const struct nic_dfx_rsp_head_t *rsp_head, uint32
 	struct nic_dfx_type_head *type_head;
 	uint8_t last_type_id = 0;
 	uint32_t *ptr = reg_data;
+	uint32_t max_size;
+	uint32_t num_u32;
 	uint8_t i;
 
+	max_size = dfx_get_max_reg_bffer_size(rsp_head);
+	for (i = 0; i < rsp_head->total_type_num; i++) {
+		type_head = (struct nic_dfx_type_head *)ptr;
+		num_u32 = type_head->reg_num * WORD_NUM_PER_REG + 1; /* including type_head */
+		if (max_size < num_u32 * sizeof(uint32_t)) {
+			HIKP_ERROR_PRINT("register real size exceeds the max size\n");
+			return;
+		}
+		ptr += num_u32;
+		max_size -= num_u32 * sizeof(uint32_t);
+	}
+
+	ptr = reg_data;
 	printf("****************** module %s reg dump start ********************\n",
 		g_dfx_module_parse[g_dfx_param.module_idx].module_name);
 	for (i = 0; i < rsp_head->total_type_num; i++) {
diff --git a/net/nic/nic_mac/hikp_nic_port.c b/net/nic/nic_mac/hikp_nic_port.c
index 725ef95..f818001 100644
--- a/net/nic/nic_mac/hikp_nic_port.c
+++ b/net/nic/nic_mac/hikp_nic_port.c
@@ -498,9 +498,16 @@ static void mac_cmd_print_cdr_dfx(struct mac_cmd_cdr_dfx *cdr_dfx, struct mac_po
 
 static void mac_cmd_disp_cdr_info(struct mac_cmd_cdr_dfx *cdr_dfx)
 {
+	uint8_t cdr_max_num = HIKP_ARRAY_SIZE(cdr_dfx->wire_cdr.dfx);
+
 	if (!cdr_dfx->cdr_num)
 		return;
 
+	if (cdr_dfx->cdr_num > cdr_max_num) {
+		printf("the cdr_num(%u) exceeds %u\n", cdr_dfx->cdr_num, cdr_max_num);
+		return;
+	}
+
 	printf("\n======================== PORT CDR INFO =======================\n");
 	printf("direct\t|addr     |lane    |type     |mode     |status   \n");
 	printf("----------------------------------------------------------------------------\n");
-- 
2.45.0.windows.1

