lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 08 Apr 2014 12:42:53 -0400 (EDT) From: David Miller <davem@...emloft.net> To: dan.carpenter@...cle.com Cc: isdn@...ux-pingi.de, yoshfuji@...ux-ipv6.org, netdev@...r.kernel.org, kernel-janitors@...r.kernel.org Subject: Re: [patch] isdnloop: several buffer overflows From: Dan Carpenter <dan.carpenter@...cle.com> Date: Tue, 8 Apr 2014 12:23:09 +0300 > There are three buffer overflows addressed in this patch. > > 1) In isdnloop_fake_err() we add an 'E' to a 60 character string and > then copy it into a 60 character buffer. I have made the destination > buffer 64 characters and I'm changed the sprintf() to a snprintf(). > > 2) In isdnloop_parse_cmd(), p points to a 6 characters into a 60 > character buffer so we have 54 characters. The ->eazlist[] is 11 > characters long. I have modified the code to return if the source > buffer is too long. > > 3) In isdnloop_command() the cbuf[] array was 60 characters long but the > max length of the string then can be up to 79 characters. I made the > cbuf array 80 characters long and changed the sprintf() to snprintf(). > I also removed the temporary "dial" buffer and changed it to use "p" > directly. > > Unfortunately, we pass the "cbuf" string from isdnloop_command() to > isdnloop_writecmd() which truncates anything over 60 characters to make > it fit in card->omsg[]. (It can accept values up to 255 characters so > long as there is a '\n' character every 60 characters). For now I have > just fixed the memory corruption bug and left the other problems in this > driver alone. > > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com> Applied and queued up for -stable, thanks. This thing is marked broken-on-smp so the impact is very close to zero. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists