Skip to contentSkip to conversation

udev fix another buffer overrun

PATCH In review Michael Buesch 3 participants 3 messages Feb 24, 2004 – Feb 28, 2004

lore
Share & tools
lore

Michael Buesch

author
#0 lore raw

PATCH 1/1 udev fix another buffer overrun

Hi,

This patch fixes just another possible buffer overrun caused by the dangerous sprintf().

udev-add.c renamed from udev-add.c.orig +8 -3
@@ -210,9 +210,14 @@
 		info("creating device partition nodes '%s[1-%i]'", filename, dev->partitions);
 		if (!fake) {
 			for (i = 1; i <= dev->partitions; i++) {
-				sprintf(partitionname, "%s%i", filename, i);
-				make_node(partitionname, dev->major,
-					  dev->minor + i, dev->mode, uid, gid);
+				retval = snprintf(partitionname, sizeof(partitionname),
+						  "%s%i", filename, i);
+				if (retval >= sizeof(partitionname)) {
+					dbg("partitionname buffer too small");
+				} else {
+					make_node(partitionname, dev->major,
+						  dev->minor + i, dev->mode, uid, gid);
+				}
 			}
 		}
 	}

--
Regards Michael Buesch [ http://www.tuxsoft.de.vu ]

-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id56&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

#1 lore raw
Quoted 4 lines · Michael Buesch

Hi,

This patch fixes just another possible buffer overrun caused by the dangerous sprintf().

The name can only be 100 bytes long and partitionname is 255 long, so it's really theroretical. But I will look at it in the next round of string-patches

thanks,
Kay

Quoted 10 lines
udev-add.c renamed from udev-add.c.orig +1 -3
@@ -210,9 +210,14 @@
 		info("creating device partition nodes '%s[1-%i]'", filename, dev->partitions);
 		if (!fake) {
 			for (i = 1; i <= dev->partitions; i++) {
-				sprintf(partitionname, "%s%i", filename, i);
-				make_node(partitionname, dev->major,
-					  dev->minor + i, dev->mode, uid, gid);
+				retval = snprintf(partitionname, sizeof(partitionname),

udev-add.c line 223

Quoted 10 lines
udev-add.c renamed from udev-add.c.orig +7 -0
+						  "%s%i", filename, i);
+				if (retval >= sizeof(partitionname)) {
+					dbg("partitionname buffer too small");
+				} else {
+					make_node(partitionname, dev->major,
+						  dev->minor + i, dev->mode, uid, gid);
+				}
 			}
 		}
 	}

-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id56&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

#2 lore raw
In reply to Michael Buesch
Quoted 4 lines · Michael Buesch

Hi,

This patch fixes just another possible buffer overrun caused by the dangerous sprintf().

This and your other buffer overflow patches are all fixed up with Kay's patches, right?

thanks,

greg k-h

-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id56&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel