linux-kernel - [PATCH 2/4] ACPI: battery: Fix buffer overread if not NUL-terminated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230114085053.72059-3-W_Armin@gmx.de>
Date:   Sat, 14 Jan 2023 09:50:51 +0100
From:   Armin Wolf <W_Armin@....de>
To:     rafael@...nel.org, lenb@...nel.org
Cc:     linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 2/4] ACPI: battery: Fix buffer overread if not NUL-terminated

If the buffer containing string data is not NUL-terminated
(which is perfectly legal according to the ACPI specification),
the acpi battery driver might not honor its length.
Fix this by limiting the amount of data to be copied to
the buffer length while also using strscpy() to make sure
that the resulting string is always NUL-terminated.
Also use '\0' instead of a plain 0.

Signed-off-by: Armin Wolf <W_Armin@....de>
---
 drivers/acpi/battery.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fb64bd217d82..9f6daa9f2010 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -438,15 +438,24 @@ static int extract_package(struct acpi_battery *battery,
 		if (offsets[i].mode) {
 			u8 *ptr = (u8 *)battery + offsets[i].offset;

-			if (element->type == ACPI_TYPE_STRING ||
-			    element->type == ACPI_TYPE_BUFFER)
+			switch (element->type) {
+			case ACPI_TYPE_STRING:
 				strscpy(ptr, element->string.pointer, 32);
-			else if (element->type == ACPI_TYPE_INTEGER) {
-				strncpy(ptr, (u8 *)&element->integer.value,
-					sizeof(u64));
+
+				break;
+			case ACPI_TYPE_BUFFER:
+				strscpy(ptr, element->buffer.pointer,
+					min_t(u32, element->buffer.length + 1, 32));
+
+				break;
+			case ACPI_TYPE_INTEGER:
+				strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64));
 				ptr[sizeof(u64)] = 0;
-			} else
-				*ptr = 0; /* don't have value */
+
+				break;
+			default:
+				*ptr = '\0'; /* don't have value */
+			}
 		} else {
 			int *x = (int *)((u8 *)battery + offsets[i].offset);
 			*x = (element->type == ACPI_TYPE_INTEGER) ?
--
2.30.2