linux-kernel - Re: CVE-2009-2584

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.01.0911050945070.31845@localhost.localdomain>
Date:	Thu, 5 Nov 2009 09:47:22 -0800 (PST)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Jiri Kosina <jkosina@...e.cz>
cc:	Michael Gilbert <michael.s.gilbert@...il.com>,
	Michael Buesch <mb@...sch.de>, Jack Steiner <steiner@....com>,
	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: CVE-2009-2584

On Thu, 5 Nov 2009, Linus Torvalds wrote:
>  {
> -	unsigned long val;
> -	char buf[80];
> +	char buf[16];

On third thought, this was too aggressive.

Using "0x%16ul" as a format on 64-bit machines is reasonable, so 19 bytes 
of buffer is not insane (with the terminating NUL). Of course, it never 
used to accept hex numbers, so it's not like it would have worked before, 
but the point is that I cut down the buffer unnecessarily strictly.

Can anybody see anything else wrong in that suggested fix?

		Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/