linux-kernel - Re: [PATCH] arch/powerpc/kernel: using %12.12s instead of %12s for avoiding memory overflow.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5177986E.9020105@asianux.com>
Date:	Wed, 24 Apr 2013 16:31:42 +0800
From:	Chen Gang <gang.chen@...anux.com>
To:	Vasant Hegde <hegdevasant@...ux.vnet.ibm.com>
CC:	"sfr@...b.auug.org.au" <sfr@...b.auug.org.au>,
	Michael Neuling <mikey@...ling.org>,
	linuxppc-dev@...ts.ozlabs.org, paulus@...ba.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] arch/powerpc/kernel: using %12.12s instead of %12s for
 avoiding memory overflow.

On 2013年04月24日 16:19, Vasant Hegde wrote:
>>>>>>     for tmp_part->header.name:
>>>>>> >>>>>       it is "Terminating null required only for names<   12 chars".
>>>>>> >>>>>       so need to limit the %.12s for it in printk
>>>>>> >>>>>
>>>>>> >>>>>     additional info:
>>>>>> >>>>>
>>>>>> >>>>>       %12s  limit the width, not for the original string output length
>>>>>> >>>>>             if name length is more than 12, it still can be fully displayed.
>>>>>> >>>>>             if name length is less than 12, the ' ' will be filled before name.
>>>>>> >>>>>
>>>>>> >>>>>       %.12s truly limit the original string output length (precision)
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>> Signed-off-by: Chen Gang<gang.chen@...anux.com>
>>>>>> >>>>> ---
>>>>>> >>>>>    arch/powerpc/kernel/nvram_64.c |    2 +-
>>>>>> >>>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>> >>>>>
>>>>>> >>>>> diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
>>>>>> >>>>> index bec1e93..57bf6d2 100644
>>>>>> >>>>> --- a/arch/powerpc/kernel/nvram_64.c
>>>>>> >>>>> +++ b/arch/powerpc/kernel/nvram_64.c
>>>>>> >>>>> @@ -202,7 +202,7 @@ static void __init nvram_print_partitions(char * label)
>>>>>> >>>>>    	printk(KERN_WARNING "--------%s---------\n", label);
>>>>>> >>>>>    	printk(KERN_WARNING "indx\t\tsig\tchks\tlen\tname\n");
>>>>>> >>>>>    	list_for_each_entry(tmp_part,&nvram_partitions, partition) {
>>>>>> >>>>> -		printk(KERN_WARNING "%4d    \t%02x\t%02x\t%d\t%12s\n",
>>>>>> >>>>> +		printk(KERN_WARNING "%4d    \t%02x\t%02x\t%d\t%12.12s\n",
>> > 
>> > First, this code in inside NVRAM_DEBUG which is used only for debug purpose and
>> > AFAIK, all partition names are less than 20 character. So I don't think we need
> Sorry.. I meant 12 character.

Please see line 283:
  "strncpy(part->header.name, "wwwwwwwwwwww", 12);"
  (it is not a NUL terminated string, and the length is 12)

And also, can we be sure that all partition names should be less than 12
characters ?

All together, I think we still need %12.12s to protect the memory.

Thanks.

-- 
Chen Gang

Asianux Corporation
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/