LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Jesper Juhl <jj@chaosbits.net>
To: linux-kernel@vger.kernel.org
Cc: James Morris <jmorris@intercode.com.au>,
	James Morris <jmorris@namei.org>,
	"David S. Miller" <davem@redhat.com>,
	David Miller <davem@davemloft.net>,
	Steve French <sfrench@us.ibm.com>,
	Steve French <smfrench@gmail.com>,
	Andrew Tridgell <tridge@samba.org>
Subject: [PATCH] Do not potentially overflow string in sumversion
Date: Fri, 21 Jan 2011 00:00:56 +0100 (CET)	[thread overview]
Message-ID: <alpine.LNX.2.00.1101202353010.11854@swampdragon.chaosbits.net> (raw)

In scripts/mod/sumversion.c (in get_src_version()) we call 
getenv("MODVERDIR"). This returns a pointer to a string of unknown length. 
This string of unknown length we then pass on as an argument to sprintf() 
and tell it to write the result to 'filelist' which has a, very much 
fixed, size of 'PATH_MAX + 1'. If the string returned by getenv() is too 
long we'll overrun the statically allocated buffer.
This patch prevents the buffer overrun by using snprintf() and telling it 
to copy a maximum of 'PATH_MAX + 1' bytes (including the terminating \0).

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
 sumversion.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

  compile tested only

diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index ecf9c7d..35e9404 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -401,7 +401,7 @@ void get_src_version(const char *modname, char sum[], unsigned sumlen)
 		basename = strrchr(modname, '/') + 1;
 	else
 		basename = modname;
-	sprintf(filelist, "%s/%.*s.mod", modverdir,
+	snprintf(filelist, PATH_MAX + 1, "%s/%.*s.mod", modverdir,
 		(int) strlen(basename) - 2, basename);
 
 	file = grab_file(filelist, &len);


-- 
Jesper Juhl <jj@chaosbits.net>            http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.


             reply	other threads:[~2011-01-20 23:00 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-01-20 23:00 Jesper Juhl [this message]
2011-01-21  6:18 ` WANG Cong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.LNX.2.00.1101202353010.11854@swampdragon.chaosbits.net \
    --to=jj@chaosbits.net \
    --cc=davem@davemloft.net \
    --cc=davem@redhat.com \
    --cc=jmorris@intercode.com.au \
    --cc=jmorris@namei.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sfrench@us.ibm.com \
    --cc=smfrench@gmail.com \
    --cc=tridge@samba.org \
    --subject='Re: [PATCH] Do not potentially overflow string in sumversion' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).