linux-kernel - Re: [PATCH] more get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 23 Sep 2006 20:57:10 +0100
From:	Al Viro <viro@....linux.org.uk>
To:	Linus Torvalds <torvalds@...l.org>
Cc:	linux-kernel@...r.kernel.org,
	linux-fbdev-devel@...ts.sourceforge.net
Subject: Re: [PATCH] more get_property() fallout

On Sat, Sep 23, 2006 at 06:21:35PM +0100, Al Viro wrote:
> Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
> ---
>  drivers/video/riva/fbdev.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
> index 61a4665..4acde4f 100644
> --- a/drivers/video/riva/fbdev.c
> +++ b/drivers/video/riva/fbdev.c
> @@ -1826,7 +1826,7 @@ static int __devinit riva_get_EDID_OF(st
>  {
>  	struct riva_par *par = info->par;
>  	struct device_node *dp;
> -	unsigned char *pedid = NULL;
> +	const unsigned char *pedid = NULL;

Ho-hum...  Actually, that looks like a genuine bug.  Look:

rivafb_probe():
	riva_get_EDID(info, pd);
	riva_get_edidinfo(info);

riva_get_EDID() -> riva_get_EDID_OF() ->
                        pedid = get_property(dp, propnames[i], NULL);
                        if (pedid != NULL) {
                                par->EDID = pedid;
                                NVTRACE("LCD found.\n");
                                return 1;
                        }
then in 
riva_get_edidinfo():
        struct riva_par *par = info->par;

        fb_edid_to_monspecs(par->EDID, &info->monspecs);

fb_edid_to_monspecs() -> edid_checksum() -> fix_edid() -> modifies the string.

What's worse, fb_edid_to_monspecs() appears to assume that the string it
got is long enough.  So... what the hell is going on there?  I'd probably
did kmalloc() and copy that sucker there, making sure that it _is_ long
enough for fbmon.c while we are at it.  Other suggestions?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/