linux-kernel - Re: buffer overflows in the tty flip buffer in 2.6.17

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45D6FFC4.4030205@gmail.com>
Date:	Sat, 17 Feb 2007 14:14:44 +0100
From:	Jiri Slaby <jirislaby@...il.com>
To:	Mockern@...dex.ru
Cc:	linux-kernel@...r.kernel.org
Subject: Re: buffer overflows in the tty flip buffer in 2.6.17

Mockern napsal(a):
> When data is received from the hardware, it needs to be placed into the tty device's flip buffer. This can be done with the following bit of code:
> 

> for (i = 0; i < data_size; ++i) {
>         if (tty->flip.count >= TTY_FLIPBUF_SIZE)
>                 tty_flip_buffer_push(tty);
>         tty_insert_flip_char(tty, data[i], 0);
> }
> tty_flip_buffer_push(tty);

size = tty_buffer_request_room(tty, data_size);
tty_insert_flip_string(tty, data, min(data_size, size));
tty_flip_buffer_push(tty);
+ cope with size < data_size (some data_size -= size with 3 lines above in do {} 
while (data_size))

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

Hnus <hnus@...muni.cz> is an alias for /dev/null
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/