Messages in this thread | | | Date | Thu, 14 May 2009 08:24:52 +1000 (EST) | From | James Morris <> | Subject | Re: [PATCH] TPM: get_event_name stack corruption |
| |
On Wed, 13 May 2009, Eric Paris wrote:
> get_event_name uses sprintf to fill a buffer declared on the stack. It fills > the buffer 2 bytes at a time. What the code doesn't take into account is that > sprintf(buf, "%02x", data) actually writes 3 bytes. 2 bytes for the data and > then it nul terminates the string. Since we declare buf to be 40 characters > long and then we write 40 bytes of data into buf sprintf is going to write 41 > characters. The fix is to leave room in buf for the nul terminator. > > Signed-off-by: Eric Paris <eparis@redhat.com>
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
> --- > > drivers/char/tpm/tpm_bios.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c > index ed306eb..0c2f55a 100644 > --- a/drivers/char/tpm/tpm_bios.c > +++ b/drivers/char/tpm/tpm_bios.c > @@ -212,7 +212,8 @@ static int get_event_name(char *dest, struct tcpa_event *event, > unsigned char * event_entry) > { > const char *name = ""; > - char data[40] = ""; > + /* 41 so there is room for 40 data and 1 nul */ > + char data[41] = ""; > int i, n_len = 0, d_len = 0; > struct tcpa_pc_event *pc_event; > >
-- James Morris <jmorris@namei.org>
| |