array underflow in receive_SyncParam()?

[Dan Carpenter]

I had a question about the following code:

drivers/block/drbd/drbd_receiver.c
  2808                  if (apv == 88) {
  2809                          if (data_size > SHARED_SECRET_MAX) {
  2810                                  dev_err(DEV, "verify-alg too long, "
  2811                                      "peer wants %u, accepting only %u byte\n",
  2812                                                  data_size, SHARED_SECRET_MAX);
  2813                                  return false;
  2814                          }
  2815  
  2816                          if (drbd_recv(mdev, p->verify_alg, data_size) != data_size)
  2817                                  return false;
  2818  
  2819                          /* we expect NUL terminated string */
  2820                          /* but just in case someone tries to be evil */
  2821                          D_ASSERT(p->verify_alg[data_size-1] == 0);
  2822                          p->verify_alg[data_size-1] = 0;
                                              ^^^^^^^^^
Is it possible for data_size to be zero here leading to an array
underflow?  We test for overflows, but I don't see any place where we
test for zero.

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/