linux-kernel - [PATCH] kconfig: nconf: fix core dump when searching in empty menu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 10 Apr 2021 15:52:46 +0900
From:   Masahiro Yamada <masahiroy@...nel.org>
To:     linux-kbuild@...r.kernel.org
Cc:     Masahiro Yamada <masahiroy@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] kconfig: nconf: fix core dump when searching in empty menu

The following code in get_mext_match():

  index = (index + items_num) % items_num;

... makes the program crash when items_num is zero (that is, the menu
is empty).

A menu can be empty when all the options in it are hidden by unmet
'depends on'.

For example,

  menu "This menu will be empty"

  config FOO
         bool "foo"
         depends on BROKEN

  endmenu

If you visit this menu and press a '/' key and then another key, nconf
crashes with:

  Floating point exception (core dumped)

When the number of items is zero, it does not make sense to search in
the menu. In this case, current_item() returns NULL, and item_index()
ERR, but the current get_mext_match() does not check any error.

Let's make it just return if items_num is zero, and also check the
return value from item_index() just in case.

Change items_num from 'int' to 'unsigned int' because it should never
become negative.

Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>
---

 scripts/kconfig/nconf.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
index 42d63d7b0c52..7d2ab2944d81 100644
--- a/scripts/kconfig/nconf.c
+++ b/scripts/kconfig/nconf.c
@@ -282,7 +282,7 @@ static int mwin_max_cols;
 static MENU *curses_menu;
 static ITEM *curses_menu_items[MAX_MENU_ITEMS];
 static struct mitem k_menu_items[MAX_MENU_ITEMS];
-static int items_num;
+static unsigned int items_num;
 static int global_exit;
 /* the currently selected button */
 static const char *current_instructions = menu_instructions;
@@ -510,8 +510,14 @@ typedef enum {MATCH_TINKER_PATTERN_UP, MATCH_TINKER_PATTERN_DOWN,
 /* return the index of the matched item, or -1 if no such item exists */
 static int get_mext_match(const char *match_str, match_f flag)
 {
-	int match_start = item_index(current_item(curses_menu));
-	int index;
+	int match_start, index;
+
+	if (items_num == 0)
+		return -1;
+
+	match_start = item_index(current_item(curses_menu));
+	if (match_start == ERR)
+		return -1;
 
 	if (flag == FIND_NEXT_MATCH_DOWN)
 		++match_start;
-- 
2.27.0