linux-kernel - Re: [PATCH] tools/thermal: Fix possible path truncations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 3 Aug 2022 19:14:16 +0200
From:   Daniel Lezcano <daniel.lezcano@...aro.org>
To:     "Rafael J. Wysocki" <rafael@...nel.org>,
        Florian Fainelli <f.fainelli@...il.com>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Markus Mayer <mmayer@...adcom.com>,
        Amit Kucheria <amitk@...nel.org>,
        Zhang Rui <rui.zhang@...el.com>,
        Jacob Pan <jacob.jun.pan@...ux.intel.com>,
        "open list:THERMAL" <linux-pm@...r.kernel.org>
Subject: Re: [PATCH] tools/thermal: Fix possible path truncations

On 03/08/2022 19:07, Rafael J. Wysocki wrote:
> On Mon, Jul 25, 2022 at 7:38 PM Florian Fainelli <f.fainelli@...il.com> wrote:
>>
>> A build with -D_FORTIFY_SOURCE=2 enabled will produce the following warnings:
>>
>> sysfs.c:63:30: warning: '%s' directive output may be truncated writing up to 255 bytes into a region of size between 0 and 255 [-Wformat-truncation=]
>>    snprintf(filepath, 256, "%s/%s", path, filename);
>>                                ^~
>> Bump up the buffer to PATH_MAX which is the limit and account for all of
>> the possible NUL and separators that could lead to exceeding the
>> allocated buffer sizes.
>>
>> Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal subsystem")
>> Signed-off-by: Florian Fainelli <f.fainelli@...il.com>
> 
> Daniel, are you going to pick up this one or should I?
> 
> There is also a tmon patch from Florian that seems to be pending.
> Should I take care of it?

Mmh, let me check. I thought I picked them :/

-- 
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog