lkml.org 
[lkml]   [2018]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.14 070/100] 509: fix printing uninitialized stack memory when OID is empty
    Date
    From: Eric Biggers <ebiggers3@gmail.com>

    [ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ]

    Callers of sprint_oid() do not check its return value before printing
    the result. In the case where the OID is zero-length, -EBADMSG was
    being returned without anything being written to the buffer, resulting
    in uninitialized stack memory being printed. Fix this by writing
    "(bad)" to the buffer in the cases where -EBADMSG is returned.

    Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings")
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    lib/oid_registry.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    diff --git a/lib/oid_registry.c b/lib/oid_registry.c
    index 41b9e50711a7..b5f7d9986be1 100644
    --- a/lib/oid_registry.c
    +++ b/lib/oid_registry.c
    @@ -116,7 +116,7 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
    int count;

    if (v >= end)
    - return -EBADMSG;
    + goto bad;

    n = *v++;
    ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
    @@ -134,7 +134,7 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
    num = n & 0x7f;
    do {
    if (v >= end)
    - return -EBADMSG;
    + goto bad;
    n = *v++;
    num <<= 7;
    num |= n & 0x7f;
    @@ -148,6 +148,10 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
    }

    return ret;
    +
    +bad:
    + snprintf(buffer, bufsize, "(bad)");
    + return -EBADMSG;
    }
    EXPORT_SYMBOL_GPL(sprint_oid);

    --
    2.11.0
    \
     
     \ /
      Last update: 2018-01-29 00:03    [W:4.100 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site