lkml.org 
[lkml]   [2018]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 075/254] X.509: fix buffer overflow detection in sprint_oid()
    3.16.55-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit 47e0a208fb9d91e3f3c86309e752b13a36470ae8 upstream.

    In sprint_oid(), if the input buffer were to be more than 1 byte too
    small for the first snprintf(), 'bufsize' would underflow, causing a
    buffer overflow when printing the remainder of the OID.

    Fortunately this cannot actually happen currently, because no users pass
    in a buffer that can be too small for the first snprintf().

    Regardless, fix it by checking the snprintf() return value correctly.

    For consistency also tweak the second snprintf() check to look the same.

    Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings")
    Cc: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Reviewed-by: James Morris <james.l.morris@oracle.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    lib/oid_registry.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    --- a/lib/oid_registry.c
    +++ b/lib/oid_registry.c
    @@ -120,10 +120,10 @@ int sprint_oid(const void *data, size_t

    n = *v++;
    ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
    + if (count >= bufsize)
    + return -ENOBUFS;
    buffer += count;
    bufsize -= count;
    - if (bufsize == 0)
    - return -ENOBUFS;

    while (v < end) {
    num = 0;
    @@ -141,9 +141,9 @@ int sprint_oid(const void *data, size_t
    } while (n & 0x80);
    }
    ret += count = snprintf(buffer, bufsize, ".%lu", num);
    - buffer += count;
    - if (bufsize <= count)
    + if (count >= bufsize)
    return -ENOBUFS;
    + buffer += count;
    bufsize -= count;
    }

    \
     
     \ /
      Last update: 2018-02-28 16:24    [W:4.102 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site