linux-kernel - RE: [PATCH 5/5] Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Oct 2018 19:57:10 +0000
From:   Dexuan Cui <decui@...rosoft.com>
To:     Greg KH <gregkh@...uxfoundation.org>,
        KY Srinivasan <kys@...rosoft.com>
CC:     "olaf@...fle.de" <olaf@...fle.de>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "jasowang@...hat.com" <jasowang@...hat.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Stable@...r.kernel.org" <Stable@...r.kernel.org>,
        Michael Kelley <mikelley@...rosoft.com>,
        "apw@...onical.com" <apw@...onical.com>,
        "devel@...uxdriverproject.org" <devel@...uxdriverproject.org>,
        vkuznets <vkuznets@...hat.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>
Subject: RE: [PATCH 5/5] Tools: hv: kvp: Fix a warning of buffer overflow with
 gcc 8.0.1

> From: devel <driverdev-devel-bounces@...uxdriverproject.org> On Behalf Of
> Greg KH
> Sent: Tuesday, October 16, 2018 22:07
> 
> On Wed, Oct 17, 2018 at 03:14:06AM +0000, kys@...uxonhyperv.com wrote:
> > From: Dexuan Cui <decui@...rosoft.com>
> >
> > The patch fixes:
> >
> > hv_kvp_daemon.c: In function 'kvp_set_ip_info':
> > hv_kvp_daemon.c:1305:2: note: 'snprintf' output between 41 and 4136 bytes
> > into a destination of size 4096
> > ...
> > --- a/tools/hv/hv_kvp_daemon.c
> > +++ b/tools/hv/hv_kvp_daemon.c
> > @@ -1176,7 +1176,7 @@ static int kvp_set_ip_info(char *if_name, struct
> hv_kvp_ipaddr_value *new_val)
> >  	int error = 0;
> >  	char if_file[PATH_MAX];
> >  	FILE *file;
> > -	char cmd[PATH_MAX];
> > +	char cmd[PATH_MAX * 2];
> 
> Overkill?

Well, I found the -Wformat-truncation warning can be suppressed by checking
the return value of snprintf, so I'm going to do a new patch for KY to resend like this:

@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
        FILE *file;
        char cmd[PATH_MAX];
        char *mac_addr;
+       int str_len;

        /*
         * Set the configuration for the specified interface with
@@ -1301,8 +1302,19 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
         * invoke the external script to do its magic.
         */

-       snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
-                "hv_set_ifconfig", if_file);
+       str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
+                    "hv_set_ifconfig", if_file);
+
+       /*
+        * This is a little overcautious, but it's necessary to suppress some
+        * false warnings from gcc 8.0.1.
+        */
+       if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) {
+               syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long",
+                      cmd, str_len);
+               return HV_E_FAIL;
+       }


Thanks,
-- Dexuan