linux-kernel - [PATCH 4.9 021/102] staging/speakup: fix get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200401161536.887321525@linuxfoundation.org>
Date:   Wed,  1 Apr 2020 18:17:24 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Kirk Reiser <kirk@...sers.ca>,
        Janina Sajka <janina@...note.net>,
        Alexandr Epaneshnikov <aarnaarn2@...il.com>,
        Gregory Nowak <greg@...gn.net>,
        deedra waters <deedra@...-brannons.com>,
        Samuel Thibault <samuel.thibault@...-lyon.org>,
        Michael Taboada <michael@...haels.world>
Subject: [PATCH 4.9 021/102] staging/speakup: fix get_word non-space look-ahead

From: Samuel Thibault <samuel.thibault@...-lyon.org>

commit 9d32c0cde4e2d1343dfb88a67b2ec6397705b32b upstream.

get_char was erroneously given the address of the pointer to the text
instead of the address of the text, thus leading to random crashes when
the user requests speaking a word while the current position is on a space
character and say_word_ctl is not enabled.

Reported-on: https://github.com/bytefire/speakup/issues/1
Reported-by: Kirk Reiser <kirk@...sers.ca>
Reported-by: Janina Sajka <janina@...note.net>
Reported-by: Alexandr Epaneshnikov <aarnaarn2@...il.com>
Reported-by: Gregory Nowak <greg@...gn.net>
Reported-by: deedra waters <deedra@...-brannons.com>
Signed-off-by: Samuel Thibault <samuel.thibault@...-lyon.org>
Tested-by: Alexandr Epaneshnikov <aarnaarn2@...il.com>
Tested-by: Gregory Nowak <greg@...gn.net>
Tested-by: Michael Taboada <michael@...haels.world>
Cc: stable <stable@...r.kernel.org>
Link: https://lore.kernel.org/r/20200306003047.thijtmqrnayd3dmw@function
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 drivers/staging/speakup/main.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -565,8 +565,7 @@ static u_long get_word(struct vc_data *v
 		return 0;
 	} else if ((tmpx < vc->vc_cols - 2)
 		   && (ch == SPACE || ch == 0 || IS_WDLM(ch))
-		   && ((char)get_char(vc, (u_short *) &tmp_pos + 1, &temp) >
-		       SPACE)) {
+		   && ((char)get_char(vc, (u_short *)tmp_pos + 1, &temp) > SPACE)) {
 		tmp_pos += 2;
 		tmpx++;
 	} else