linux-kernel - Re: [PATCH][RFC] HPFS: Don't use pointer to out-of-scope array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Jan 2011 23:08:10 +0100 (CET)
From:	Jesper Juhl <jj@...osbits.net>
To:	Andreas Schwab <schwab@...ux-m68k.org>
cc:	linux-kernel@...r.kernel.org,
	Mikulas Patocka <mikulas@...ax.karlin.mff.cuni.cz>
Subject: Re: [PATCH][RFC] HPFS: Don't use pointer to out-of-scope array

On Fri, 24 Dec 2010, Jesper Juhl wrote:

> On Fri, 24 Dec 2010, Andreas Schwab wrote:
> 
> > Jesper Juhl <jj@...osbits.net> writes:
> > 
> > > Secondly I fail to see how this code inside the while loop can even work:
> > >
> > >   if (hpfs_ea_read(s, a, ano, pos + 4, ea->namelen + 1 + (ea->indirect ? 8 : 0), ex + 4))
> > >
> > > There is nothing initializing 'ex' which 'ea' points to, so 
> > > 'ea->namelen' and 'ea->indirect' are uninitialized.
> > 
> > The preceding hpfs_ea_read should do it (it reads the first 4 bytes of
> > ex which aliases ea->namelen and ea->indirect).
> > 
> How I managed to miss that I don't know, but I did and you are correct. 
> Thanks.
> 
But, this bit: "in the 'while (pos < len)' loop a local char array 'ex' is 
defined and subsequently the pointer variable 'ea' is set to point to the 
array. Inside the loop we may jump to the 'indirect' label which is 
outside the loop scope. At the 'indirect' label 'ea' (which now points 
to a array that is no longer in scope) is dereferenced - that's not good. 
The patch below addresses that problem by moving the 'ex' array out of 
the loop scope and into function scope."
I still believe to be correct and that's what the patch actually 
addresses, so can we agree that the patch makes sense and should be 
merged?

-- 
Jesper Juhl <jj@...osbits.net>            http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/