lkml.org 
[lkml]   [2009]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] TPM: get_event_name stack corruption
On Wed, 13 May 2009, Eric Paris wrote:

> get_event_name uses sprintf to fill a buffer declared on the stack. It fills
> the buffer 2 bytes at a time. What the code doesn't take into account is that
> sprintf(buf, "%02x", data) actually writes 3 bytes. 2 bytes for the data and
> then it nul terminates the string. Since we declare buf to be 40 characters
> long and then we write 40 bytes of data into buf sprintf is going to write 41
> characters. The fix is to leave room in buf for the nul terminator.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

> ---
>
> drivers/char/tpm/tpm_bios.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
> index ed306eb..0c2f55a 100644
> --- a/drivers/char/tpm/tpm_bios.c
> +++ b/drivers/char/tpm/tpm_bios.c
> @@ -212,7 +212,8 @@ static int get_event_name(char *dest, struct tcpa_event *event,
> unsigned char * event_entry)
> {
> const char *name = "";
> - char data[40] = "";
> + /* 41 so there is room for 40 data and 1 nul */
> + char data[41] = "";
> int i, n_len = 0, d_len = 0;
> struct tcpa_pc_event *pc_event;
>
>

--
James Morris
<jmorris@namei.org>


\
 
 \ /
  Last update: 2009-05-14 00:29    [W:1.177 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site