linux-kernel - [PATCH 3/3] lib: add range check to avoid overflow simple

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 13 May 2008 16:57:44 -0700
From:	Harvey Harrison <harvey.harrison@...il.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Alexey Dobriyan <adobriyan@...il.com>
Subject: [PATCH 3/3] lib: add range check to avoid overflow
	simple_strtoul/ull

Add a simple range check to avoid overflowing an UL, ULL
respectively.  The strict versions will catch this case now
as the strlen call will be longer than the number of characters
read. Previously, the simple function would read as long as there
were valied hexadecimal characters remaining.

The simple_strtol/ll still can overflow producing sign errors, but
maybe those users should be using the strict versions then?

Signed-off-by: Harvey Harrison <harvey.harrison@...il.com>
---
As Alexey noted, the strict versions are a bit of a joke if they
can overflow in the simple cases, here's one way of closing the
gap for the strict functions and simple_strtoul/simple_strtoull

simple_strtol/simple_strtoll still has a (narrower) chance at overflow
and is not totally safe...use the strict versions then.

 lib/vsprintf.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 3547fb5..89f2620 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -57,6 +57,7 @@ static u8 chartou8(char ch)
 unsigned long simple_strtoul(const char *cp, char **endp, unsigned int base)
 {
 	unsigned long result = 0;
+	unsigned long maxval;
 	u8 value;
 
 	if (!base)
@@ -65,9 +66,12 @@ unsigned long simple_strtoul(const char *cp, char **endp, unsigned int base)
 	if (base == 16 && cp[0] == '0' && TOLOWER(cp[1]) == 'x')
 			cp += 2;
 
+	maxval = ULONG_MAX / base;
 	while (isxdigit(*cp) && (value = chartou8(*cp) < base)) {
 		result = result * base + value;
 		cp++;
+		if (result > maxval)
+			break;
 	}
 
 	if (endp)
@@ -99,6 +103,7 @@ EXPORT_SYMBOL(simple_strtol);
 unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int base)
 {
 	unsigned long long result = 0;
+	unsigned long long maxval;
 	u8 value;
 
 	if (!base)
@@ -107,9 +112,12 @@ unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int bas
 	if (base == 16 && cp[0] == '0' && TOLOWER(cp[1]) == 'x')
 		cp += 2;
 
+	maxval = ULLONG_MAX / base;
 	while (isxdigit(*cp) && (value = chartou8(*cp) < base)) {
 		result = result * base + value;
 		cp++;
+		if (result > maxval)
+			break;
 	}
 
 	if (endp)
-- 
1.5.5.1.482.g0f174

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/