lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Mon, 18 Mar 2019 11:44:35 +0000
From:   Colin Ian King <colin.king@...onical.com>
To:     "devel@...verdev.osuosl.org" <devel@...verdev.osuosl.org>,
        John Whitmore <johnfwhitmore@...il.com>,
        Mauro Carvalho Chehab <mchehab@...hat.com>,
        Jerry Chuang <jerry-chuang@...ltek.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Greg Kroah-Hartman <gregkh@...e.de>
Subject: static analysis bug report: staging: rtl8192u: use of uninitialized
 array

Hi,

static analysis with cppcheck has detected use of an uninitialized array
tmp_ssid in drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c in
function ieee80211_softmac_new_net()

Array tmp_ssid is only initialized when ssidbroad is non-null, however
it is being copied and the copy of this is being printk'd later on:

                        if (!ssidbroad) {
                                strncpy(tmp_ssid,
ieee->current_network.ssid, IW_ESSID_MAX_SIZE);

tmp_ssid is initialized only here ^^

                                tmp_ssid_len =
ieee->current_network.ssid_len;
                        }
                        memcpy(&ieee->current_network, net,
sizeof(struct ieee80211_network));

                        strncpy(ieee->current_network.ssid, tmp_ssid,
IW_ESSID_MAX_SIZE);

tmp_ssid is being copied from here ^^

                        ieee->current_network.ssid_len = tmp_ssid_len;
                        printk(KERN_INFO"Linking with %s,channel:%d,
qos:%d, myHT:%d, networkHT:%d\n",
                               ieee->current_network.ssid,
                               ieee->current_network.channel,
                               ieee->current_network.qos_data.supported,
                               ieee->pHTInfo->bEnableHT,
                               ieee->current_network.bssht.bdSupportHT);

copy of tmp_ssid is being printk'd here ^^

So potentially a garbage non-null terminated string is being printk'd.
Not sure what the fix is for the case where ssidbroad is non-null, what
should tmp_ssid be in that situation?

Colin

Powered by blists - more mailing lists