linux-kernel - [PATCH] kconfig: fix possible buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230905095914.1699335-1-konstantin.meskhidze@huawei.com>
Date:   Tue, 5 Sep 2023 17:59:14 +0800
From:   Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
To:     <masahiroy@...nel.org>
CC:     <linux-kbuild@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <yusongping@...wei.com>, <artem.kuzin@...wei.com>
Subject: [PATCH] kconfig: fix possible buffer overflow

Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.

Fixes: e298f3b49def ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@...wei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
---
 scripts/kconfig/preprocess.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 748da578b418..d1f5bcff4b62 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -387,24 +387,27 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
 			if (new_argc >= FUNCTION_MAX_ARGS)
 				pperror("too many function arguments");
 			new_argv[new_argc++] = prev;
 			prev = p + 1;
 		} else if (*p == '(') {
 			nest++;
 		} else if (*p == ')') {
 			nest--;
 		}
 
 		p++;
 	}
+
+	if (new_argc >= FUNCTION_MAX_ARGS)
+		pperror("too many function arguments");
 	new_argv[new_argc++] = prev;
 
 	/*
 	 * Shift arguments
 	 * new_argv[0] represents a function name or a variable name.  Put it
 	 * into 'name', then shift the rest of the arguments.  This simplifies
 	 * 'const' handling.
 	 */
 	name = expand_string_with_args(new_argv[0], argc, argv);
 	new_argc--;
 	for (i = 0; i < new_argc; i++)
 		new_argv[i] = expand_string_with_args(new_argv[i + 1],
-- 
2.34.1