netdev - RE: [patch 4/7] [PATCH] ctcm: make ctcmpc debugging compilable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 7 Mar 2012 12:20:05 -0000
From:	"David Laight" <David.Laight@...LAB.COM>
To:	<frank.blaschka@...ibm.com>, <davem@...emloft.net>
Cc:	<netdev@...r.kernel.org>, <linux-s390@...r.kernel.org>,
	"Ursula Braun" <ursula.braun@...ibm.com>
Subject: RE: [patch 4/7] [PATCH] ctcm: make ctcmpc debugging compilable

>  static const struct xid2 init_xid = {
> @@ -132,7 +132,7 @@ void ctcmpc_dumpit(char *buf, int len)
>  	__u32	ct, sw, rm, dup;
>  	char	*ptr, *rptr;
>  	char	tbuf[82], tdup[82];
> -	#if (UTS_MACHINE == s390x)
> +	#ifdef CONFIG_64BIT
>  	char	addr[22];
>  	#else
>  	char	addr[12];
> @@ -149,8 +149,8 @@ void ctcmpc_dumpit(char *buf, int len)
>  
>  	for (ct = 0; ct < len; ct++, ptr++, rptr++) {
>  		if (sw == 0) {
> -			#if (UTS_MACHINE == s390x)
> -			sprintf(addr, "%16.16lx", (__u64)rptr);
> +			#ifdef CONFIG_64BIT
> +			sprintf(addr, "%16.16llx", (__u64)rptr);
>  			#else
>  			sprintf(addr, "%8.8X", (__u32)rptr);
>  			#endif

What is wrong with:
	char addr[24];
	snprintf(addr, sizeof addr, "%p", rptr);

There seemed to be other 'dangerous' unbounded string
operations in that code as well.

	David


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html