linux-kernel - Re: [PATCH V2] dtc: ensure #line directives don't consume data from the next line

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130601053057.GB12059@boomeroo.fritz.box>
Date:	Sat, 1 Jun 2013 15:30:57 +1000
From:	David Gibson <david@...son.dropbear.id.au>
To:	Stephen Warren <swarren@...dotorg.org>
Cc:	jdl@....com, mmarek@...e.cz, Stephen Warren <swarren@...dia.com>,
	linux-kbuild@...r.kernel.org, devicetree-discuss@...ts.ozlabs.org,
	linux-kernel@...r.kernel.org, rob.herring@...xeda.com,
	linuxppc-dev@...ts.ozlabs.org
Subject: Re: [PATCH V2] dtc: ensure #line directives don't consume data from
 the next line

On Fri, May 31, 2013 at 12:33:04PM -0600, Stephen Warren wrote:
> From: Stephen Warren <swarren@...dia.com>
> 
> Previously, the #line parsing regex ended with ({WS}+[0-9]+)?. The {WS}
> could match line-break characters. If the #line directive did not contain
> the optional flags field at the end, this could cause any integer data on
> the next line to be consumed as part of the #line directive parsing. This
> could cause syntax errors (i.e. #line parsing consuming the leading 0
> from a hex literal 0x1234, leaving x1234 to be parsed as cell data,
> which is a syntax error), or invalid compilation results (i.e. simply
> consuming literal 1234 as part of the #line processing, thus removing it
> from the cell data).
> 
> Fix this by replacing {WS} with [ \t] so that it can't match line-breaks.
> 
> Convert all instances of {WS}, even though the other instances should be
> irrelevant for any well-formed #line directive. This is done for
> consistency and ultimate safety.
> 
> Reported-by: Ian Campbell <Ian.Campbell@...rix.com>
> Signed-off-by: Stephen Warren <swarren@...dia.com>

Nice catch.

Acked-by: David Gibson <david@...son.dropbear.id.au>

I'll pull it into my github tree.  Jon, please either apply directly
or pull from my tree.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)