linux-kernel - [PATCH] staging: speakup: ensure we do not overrun synths array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1462832534-11128-1-git-send-email-colin.king@canonical.com>
Date:	Mon,  9 May 2016 23:22:14 +0100
From:	Colin King <colin.king@...onical.com>
To:	William Hubbs <w.d.hubbs@...il.com>,
	Chris Brannon <chris@...-brannons.com>,
	Kirk Reiser <kirk@...sers.ca>,
	Samuel Thibault <samuel.thibault@...-lyon.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Amitoj Kaur Chawla <amitoj1606@...il.com>,
	speakup@...ux-speakup.org, devel@...verdev.osuosl.org
Cc:	linux-kernel@...r.kernel.org
Subject: [PATCH] staging: speakup: ensure we do not overrun synths array

From: Colin Ian King <colin.king@...onical.com>

synth_add allows one to add MAXSYNTHS synths to the synths array;
however it always NULLifies the next synth in the array which
means that on the MAXSYNTHS synth we get an out-of-bounds write of
the NULL to the synths array.  Make the synths array MAXSYNTHS + 1
elements in size to allow for the final NULL sentinal to avoid the
out-of-bounds write.

Issue found wit CoverityScan, CID#744671

Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/staging/speakup/synth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index 4f462c3..810a214 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -18,7 +18,7 @@
 #include "serialio.h"
 
 #define MAXSYNTHS       16      /* Max number of synths in array. */
-static struct spk_synth *synths[MAXSYNTHS];
+static struct spk_synth *synths[MAXSYNTHS + 1];
 struct spk_synth *synth;
 char spk_pitch_buff[32] = "";
 static int module_status;
-- 
2.8.1