Messages in this thread Patch in this message | | | From | Rasmus Villemoes <> | Subject | [PATCH 3/4] lib/vsprintf.c: Don't try to fix pointer wrap-around | Date | Thu, 8 Jan 2015 13:14:46 +0100 |
| |
Actual kernel buffers can't wrap into the user address space. If someone manages to pass a buf/size combination that wraps, it is most likely due to a bug in the caller. Instead of trying to fix it by using a smaller part of the buffer, bail out.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> --- lib/vsprintf.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c index cf12ba86205c..1ec6a78f169b 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1733,11 +1733,9 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) str = buf; end = buf + size; - /* Make sure end is always >= buf */ - if (end < buf) { - end = ((void *)-1); - size = end - buf; - } + /* Also bail out if buf+size wraps */ + if (WARN_ON_ONCE(end < buf)) + return 0; while (*fmt) { const char *old_fmt = fmt; -- 2.1.3
| |