[lkml]   [2011]   [Jan]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] Do not potentially overflow string in sumversion
In scripts/mod/sumversion.c (in get_src_version()) we call 
getenv("MODVERDIR"). This returns a pointer to a string of unknown length.
This string of unknown length we then pass on as an argument to sprintf()
and tell it to write the result to 'filelist' which has a, very much
fixed, size of 'PATH_MAX + 1'. If the string returned by getenv() is too
long we'll overrun the statically allocated buffer.
This patch prevents the buffer overrun by using snprintf() and telling it
to copy a maximum of 'PATH_MAX + 1' bytes (including the terminating \0).

Signed-off-by: Jesper Juhl <>
sumversion.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

compile tested only

diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index ecf9c7d..35e9404 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -401,7 +401,7 @@ void get_src_version(const char *modname, char sum[], unsigned sumlen)
basename = strrchr(modname, '/') + 1;
basename = modname;
- sprintf(filelist, "%s/%.*s.mod", modverdir,
+ snprintf(filelist, PATH_MAX + 1, "%s/%.*s.mod", modverdir,
(int) strlen(basename) - 2, basename);

file = grab_file(filelist, &len);

Jesper Juhl <>
Don't top-post
Plain text mails only, please.

 \ /
  Last update: 2011-01-21 00:03    [W:0.030 / U:9.836 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site