linux-kernel - Re: [PATCH v2] ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZAgZ/xlXl59WQLul@chenyu5-mobl1>
Date:   Wed, 8 Mar 2023 13:15:43 +0800
From:   Chen Yu <yu.c.chen@...el.com>
To:     "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        Len Brown <lenb@...nel.org>,
        Robert Moore <robert.moore@...el.com>
CC:     <linux-acpi@...r.kernel.org>,
        <acpica-devel@...ts.linuxfoundation.org>,
        <linux-kernel@...r.kernel.org>,
        Hariganesh Govindarajulu <hariganesh.govindarajulu@...el.com>
Subject: Re: [PATCH v2] ACPI: tools: pfrut: Check if the input of level and
 type is in the right numeric range

On 2023-03-08 at 21:09:02 +0800, Chen Yu wrote:
> The user provides arbitrary non-numeic value to level and type, which could
> bring expected bahavior. In this case the expected behavior would be to throw
> an error.
> 
>  pfrut -h
> usage: pfrut [OPTIONS]
> code injection:
> -l, --load
> -s, --stage
> -a, --activate
> -u, --update [stage and activate]
> -q, --query
> -d, --revid
> update telemetry:
> -G, --getloginfo
> -T, --type(0:execution, 1:history)
> -L, --level(0, 1, 2, 4)
> -R, --read
> -D, --revid log
> 
>  pfrut -T A
>  pfrut -G
> log_level:0
> log_type:0
> log_revid:2
> max_data_size:65536
> chunk1_size:0
> chunk2_size:1530
> rollover_cnt:0
> reset_cnt:17
> 
> Fix this by restricting the input to be in the expected range.
> 
> Reported-by: Hariganesh Govindarajulu <hariganesh.govindarajulu@...el.com>
> Suggested-by: "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>
> Signed-off-by: Chen Yu <yu.c.chen@...el.com>
>
Please ignore this version due to broken format, I'll send a new one.
Sorry for the noise.

thanks,
Chenyu