lkml.org 
[lkml]   [2016]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] efi: fix out-of-bounds null overwrite vulnerability
On Fri, 08 Jan, at 04:47:17PM, Luck, Tony wrote:
> > But this function doesn't use snprintf(), it uses scnprintf() which
> > returns the number of characters written into buf and, because
> > scnprintf() largely follows vnsprintf(), it will never write more than
> > 'size' bytes into the buffer.
>
> if (bank && device)
> n = snprintf(msg, len, "DIMM location: %s %s ", bank, device);
>
> That looks like "snprintf", not "scnprintf" to me :-)

Oops! Can you believe I looked at the wrong function?

> What about using:
>
> msg[len] = '\0';
>
> to guarantee NUL termination?

But that may leave garbage bytes in 'rcd_decode_str' in the case where
the string isn't as long as 'len'.

How about memset()'ing the buffer to zero and deleting the NUL
termination line?

\
 
 \ /
  Last update: 2016-01-11 15:41    [W:0.765 / U:1.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site