linux-kernel - Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1Poiwb-0002rc-Lm@be1.7eggert.dyndns.org>
Date:	Sun, 13 Feb 2011 21:53:21 +0100
From:	Bodo Eggert 
	<arcoristkaputtundbrauchtdiesentext.7eggert@...fuerspam.de>
To:	Michael Tokarev <mjt@....msk.ru>, "Daniel K." <dk@...no>,
	Jesper Juhl <jj@...osbits.net>, linux-kernel@...r.kernel.org,
	linux-raid@...r.kernel.org, Neil Brown <neilb@...e.de>,
	Neil Brown <neilb@....unsw.edu.au>
Subject: Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf()  in md_check_recovery()

Michael Tokarev <mjt@....msk.ru> wrote:
> 12.02.2011 12:34, Daniel K. wrote:
>> Jesper Juhl wrote:

>>> sprintf() is dangerous - given the wrong source string it will
>>> overflow the destination. snprintf() is safer in that at least we'll
>>> never overflow the destination. Even if overflow will never happen
>>> today, code changes over time and snprintf() is just safer in the long
>>> run.
>>
>>> -                        sprintf(nm,"rd%d", rdev->raid_disk);
>>> +                        snprintf(nm, sizeof(nm), "rd%d",
>>> rdev->raid_disk);
>>>                          sysfs_remove_link(&mddev->kobj, nm);

> C'mon guys, this is pointless.  20 bytes allocated for the device
> name, and this is for raid disk number.  It is impossible to have
> more than 10^17 (20 bytes total, 2 for "rd" and on for the zero
> terminator) drives in a single array.

If you argue that you might get a buffer overflow, you'll have to check
for snprintf errors, too.
-- 
Logic: The art of being wrong with confidence... 

Friß, Spammer: tR@...eggert.dyndns.org S5xk@...eggert.dyndns.org
 loqnjg@...zy.7eggert.dyndns.org 6hs4Axaqf@...J.7eggert.dyndns.org

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/