linux-kernel - [PATCH 0/4] ACPI: battery: Fix various string handling issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230114085053.72059-1-W_Armin@gmx.de>
Date:   Sat, 14 Jan 2023 09:50:49 +0100
From:   Armin Wolf <W_Armin@....de>
To:     rafael@...nel.org, lenb@...nel.org
Cc:     linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 0/4] ACPI: battery: Fix various string handling issues

On my Dell Inspiron 3505, the battery model name was displayed
differently than when running Windows. While i first suspected an
ACPI issue, it turned out that the real reason was the ACPI battery
driver failing to handle strings larger than 32 bytes.

This caused the model name of the battery (35 bytes long, hex string)
to miss proper NUL-termination, causing a buffer overread later.
Luckely, a valid string was stored right after the now invalid string,
appending only the battery serial number to the original model name.

The first patch deals with this issues, while the second patch fixes
another problem which could happen when handling buffers. The third
patch adds a minor improvement to the string handling code  and the
fourth patch finally increases the maximum string length to avoid
truncating such larger strings.

The patch series was tested on a Dell Inspiron 3505 and appears
to work properly.

Armin Wolf (4):
  ACPI: battery: Fix missing NUL-termination with large strings
  ACPI: battery: Fix buffer overread if not NUL-terminated
  ACPI: battery: Replace strncpy() with strscpy()
  ACPI: battery: Increase maximum string length

 drivers/acpi/battery.c | 36 +++++++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 13 deletions(-)

--
2.30.2