[lkml]   [2011]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[BUG][SECURITY] Kernel stack overflow in hfs_mac2asc()
Hi lkml,

I have found there is no len nor bound checkings in hfs_mac2asc()
function against the size of the out buffer passed as parameter.
The src size can be greater than HFS_MAX_NAMELEN on malformed file
system. HFS_MAX_NAMELEN is 31 whereas src size can be set up to
255 (unsigned char).

This can lead to a basic kernel stack overflow with user controlled
data through for example hfs_readdir() which calls hfs_mac2asc() with
out buffer "allocated" on the stack.

This overflow can be simply fixed by adding bound checks on srclen
before doing the copy.

Best regards,

Clément LECIGNE,
"In Python, how do you create a string of random characters? Read a Perl
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2011-11-09 20:11    [W:0.035 / U:6.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site