linux-kernel - Re: Re: [PATCH] dev/parport: fix the array out-of-bounds risk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2024070523-singer-dweller-f1bb@gregkh>
Date: Fri, 5 Jul 2024 11:42:19 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: tuhaowen <tuhaowen@...ontech.com>
Cc: alexander.deucher@....com, huangbibo@...ontech.com,
	linux-kernel@...r.kernel.org, sudipm.mukherjee@...il.com,
	wangyuli@...ontech.com
Subject: Re: Re: [PATCH] dev/parport: fix the array out-of-bounds risk

On Fri, Jul 05, 2024 at 04:58:34PM +0800, tuhaowen wrote:
> On Fri, Jul 05, 2024 at 02:45:45PM +0800, Greg Kroah-Hartman wrote:
> 
> > I'm not disputing that this change looks correct, I'm asking that you
> > redo it and properly check the array size when writing to it so as to
> > ensure that it really is correct in case our math is incorrect
> > somewhere.
> 
> Thank you for your feedback. I have redone the change and 
> ensured that the array size is properly checked when writing to it. 
> Please find my updated patch below.
> 
> Thanks,
> 
> Haowen.Tu
> 
> 
> >From cfdf8445987147f3a7e4f1232a8c6e8a271e4a6d Mon Sep 17 00:00:00 2001
> From: tuhaowen <tuhaowen@...ontech.com>
> Date: Mon, 27 May 2024 14:34:32 +0800
> Subject: [PATCH] dev/parport: fix the array out-of-bounds risk

Sorry, we can't take inline patches like this, please read the
documentation for how to submit a new version of a patch.

But, some comments below:

>         for (dev = port->devices; dev ; dev = dev->next) {
>                 if(dev == port->cad) {
> -                       len += sprintf(buffer, "%s\n", dev->name);
> +                       len += snprintf(buffer, 64, "%s\n", dev->name);

Don't use magic numbers here and everywhere else, use sizeof() to
compute these properly everywhere.

thanks,

greg k-h