netdev - Re: [PATCH] drivers/net/wireless: need consider the not '\0' terminated string.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 20 Jan 2013 15:21:20 +0800
From:	Chen Gang <gang.chen@...anux.com>
To:	"John W. Linville" <linville@...driver.com>
CC:	linux-wireless@...r.kernel.org, netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH] drivers/net/wireless: need consider the not '\0' terminated
 string.

Hello John W. Linville:

  when you have free time, could you give a glance for this patch ?

  thanks.

gchen.


于 2013年01月08日 13:33, Chen Gang 写道:
> 
>   in ray_cs.c:
>     the a_current_ess_id is "Null terminated unless ESSID_SIZE long"
>     so we need buffer it with '\0' firstly, before using strlen or %s.
> 
>   additional information:
>     in drivers/net/wireless/rayctl.h:
>       "NULL terminated unless 32 long" is a comment at line 616, 664
>       ESSID_SIZE is 32, at line 190
>     in include/uapi/linux/wireless.h:
>       IW_ESSID_MAX_SIZE is also 32
>     in drivers/net/wireless/ray_cs.c:
>       use strncpy for it, without '\0' terminated, at line 639
>       use memcpy for it, assume not '\0' terminated in line 1092..1097
>       buffer it with '\0' firstly, before using %s, in line 2576, 2598..2600
> 
> Signed-off-by: Chen Gang <gang.chen@...anux.com>
> ---
>  drivers/net/wireless/ray_cs.c |   19 ++++++++++++++-----
>  1 file changed, 14 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
> index 598ca1c..e7cf37f 100644
> --- a/drivers/net/wireless/ray_cs.c
> +++ b/drivers/net/wireless/ray_cs.c
> @@ -1107,12 +1107,15 @@ static int ray_get_essid(struct net_device *dev, struct iw_request_info *info,
>  			 union iwreq_data *wrqu, char *extra)
>  {
>  	ray_dev_t *local = netdev_priv(dev);
> +	UCHAR tmp[IW_ESSID_MAX_SIZE + 1];
>  
>  	/* Get the essid that was set */
>  	memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
> +	memcpy(tmp, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
> +	tmp[IW_ESSID_MAX_SIZE] = '\0';
>  
>  	/* Push it out ! */
> -	wrqu->essid.length = strlen(extra);
> +	wrqu->essid.length = strlen(tmp);
>  	wrqu->essid.flags = 1;	/* active */
>  
>  	return 0;
> @@ -1842,6 +1845,8 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
>  	UCHAR tmp;
>  	UCHAR cmd;
>  	UCHAR status;
> +	UCHAR memtmp[ESSID_SIZE + 1];
> +
>  
>  	if (dev == NULL)	/* Note that we want interrupts with dev->start == 0 */
>  		return IRQ_NONE;
> @@ -1901,17 +1906,21 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
>  			break;
>  		case CCS_START_NETWORK:
>  		case CCS_JOIN_NETWORK:
> +			memcpy(memtmp, local->sparm.b4.a_current_ess_id,
> +								ESSID_SIZE);
> +			memtmp[ESSID_SIZE] = '\0';
> +
>  			if (status == CCS_COMMAND_COMPLETE) {
>  				if (readb
>  				    (&pccs->var.start_network.net_initiated) ==
>  				    1) {
>  					dev_dbg(&link->dev,
>  					      "ray_cs interrupt network \"%s\" started\n",
> -					      local->sparm.b4.a_current_ess_id);
> +					      memtmp);
>  				} else {
>  					dev_dbg(&link->dev,
>  					      "ray_cs interrupt network \"%s\" joined\n",
> -					      local->sparm.b4.a_current_ess_id);
> +					      memtmp);
>  				}
>  				memcpy_fromio(&local->bss_id,
>  					      pccs->var.start_network.bssid,
> @@ -1939,12 +1948,12 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
>  				if (status == CCS_START_NETWORK) {
>  					dev_dbg(&link->dev,
>  					      "ray_cs interrupt network \"%s\" start failed\n",
> -					      local->sparm.b4.a_current_ess_id);
> +					      memtmp);
>  					local->timer.function = start_net;
>  				} else {
>  					dev_dbg(&link->dev,
>  					      "ray_cs interrupt network \"%s\" join failed\n",
> -					      local->sparm.b4.a_current_ess_id);
> +					      memtmp);
>  					local->timer.function = join_net;
>  				}
>  				add_timer(&local->timer);
> 


-- 
Chen Gang

Asianux Corporation
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html