linux-kernel - [PATCH V3 2/5] scripts/kconfig/nconf: fix memmove's length arg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1314899542-5848-2-git-send-email-crquan@gmail.com>
Date:	Thu,  1 Sep 2011 10:52:19 -0700
From:	crquan@...il.com
To:	linux-kbuild@...r.kernel.org, Arnaud Lacombe <lacombar@...il.com>
Cc:	Sam Ravnborg <sam@...nborg.org>, Michal Marek <mmarek@...e.cz>,
	Nir Tzachar <nir.tzachar@...il.com>,
	Randy Dunlap <rdunlap@...otime.net>,
	linux-kernel@...r.kernel.org, c.rq541@...cast.net
Subject: [PATCH V3 2/5] scripts/kconfig/nconf: fix memmove's length arg

From: Cheng Renquan <crquan@...il.com>

In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only
(len-cursor_position+1) bytes;
the default case is to insert a char, it should also memmove exactly
(len-cursor_position+1) bytes;

the original use of (len+1) is wrong and may access following memory
that doesn't belong to result, may cause SegFault in theory;

	case KEY_BACKSPACE:
		if (cursor_position > 0) {
			memmove(&result[cursor_position-1],
					&result[cursor_position],
					len-cursor_position+1);
			cursor_position--;
		}
		break;
	case KEY_DC:
		if (cursor_position >= 0 && cursor_position < len) {
			memmove(&result[cursor_position],
					&result[cursor_position+1],
					len-cursor_position+1);
		}
		break;
	default:
		if ((isgraph(res) || isspace(res)) &&
				len-2 < result_len) {
			/* insert the char at the proper position */
			memmove(&result[cursor_position+1],
					&result[cursor_position],
					len-cursor_position+1);
			result[cursor_position] = res;
			cursor_position++;
		}

Signed-off-by: Cheng Renquan <crquan@...il.com>
Acked-by: Nir Tzachar <nir.tzachar@...il.com>
---
 scripts/kconfig/nconf.gui.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
index d3af04e..3ce2a7c 100644
--- a/scripts/kconfig/nconf.gui.c
+++ b/scripts/kconfig/nconf.gui.c
@@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window,
 				/* insert the char at the proper position */
 				memmove(&result[cursor_position+1],
 						&result[cursor_position],
-						len+1);
+						len-cursor_position+1);
 				result[cursor_position] = res;
 				cursor_position++;
 			} else {
-- 
1.7.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/