linux-kernel - [PATCH] fix oops on rmmod capidrv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200801241750.14669.gerd.von.egidy@intra2net.com>
Date:	Thu, 24 Jan 2008 17:50:14 +0100
From:	"Gerd v. Egidy" <gerd.von.egidy@...ra2net.com>
To:	linux-kernel@...r.kernel.org
Cc:	kkeil@...e.de, kai.germaschewski@....de,
	isdn4linux@...tserv.isdn4linux.de
Subject: [PATCH] fix oops on rmmod capidrv

Hi,

I think the patch below fixes a long-standing bug on rmmod capidrv. Please 
apply.

Kind regards,

Gerd

Fix overwriting the stack with the version string
(it is currently 10 bytes + zero) when unloading the
capidrv module. Safeguard against overwriting it
should the version string grow in the future.

Should fix Kernel Bug Tracker Bug 9696.

Signed-off-by: Gerd v. Egidy <gerd.von.egidy@...ra2net.com>

diff -r -u linux-2.6.23.orig/drivers/isdn/capi/capidrv.c 
linux-2.6.23/drivers/isdn/capi/capidrv.c
--- linux-2.6.23.orig/drivers/isdn/capi/capidrv.c	Tue Oct  9 22:31:38 2007
+++ linux-2.6.23/drivers/isdn/capi/capidrv.c	Thu Jan 24 16:47:55 2008
@@ -2306,13 +2306,14 @@
 
 static void __exit capidrv_exit(void)
 {
-	char rev[10];
+	char rev[32];
 	char *p;
 
 	if ((p = strchr(revision, ':')) != 0) {
-		strcpy(rev, p + 1);
-		p = strchr(rev, '$');
-		*p = 0;
+		strncpy(rev, p + 1, sizeof(rev));
+		rev[sizeof(rev)-1] = 0;
+		if ((p = strchr(rev, '$')) != 0)
+			*p = 0;
 	} else {
 		strcpy(rev, " ??? ");
 	}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/