netdev - [patch] isdn/gigaset: off by one check leading to oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130117074405.GA26270@elgon.mountain>
Date:	Thu, 17 Jan 2013 10:44:05 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Hansjoerg Lipp <hjlipp@....de>
Cc:	Tilman Schmidt <tilman@...p.cc>,
	Karsten Keil <isdn@...ux-pingi.de>,
	gigaset307x-common@...ts.sourceforge.net, netdev@...r.kernel.org,
	kernel-janitors@...r.kernel.org
Subject: [patch] isdn/gigaset: off by one check leading to oops

If l == 12 then later we subtract 12 leaving zero.  We do a zero size
allocation, so "dbgline" points to the ZERO_SIZE_PTR.  It leads to an
oops when we set the NUL terminator:
	dbgline[3 * l - 1] = '\0';

Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
---
Static analysis stuff.

diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index 68452b7..0d34325 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -239,7 +239,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
 		return;
 
 	l = CAPIMSG_LEN(data);
-	if (l < 12) {
+	if (l <= 12) {
 		gig_dbg(level, "%s: ??? LEN=%04d", tag, l);
 		return;
 	}
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html