cmdline: fix get_options() overflow while parsing ranges
PATCH 1/1 cmdline: fix get_options() overflow while parsing ranges
Andrew, this seems to have fallen through the cracks. It addresses a real bug with possible security considerations and should probably get merged with a CC: stable...?
jon
Begin forwarded message:
Date: Mon, 22 May 2017 19:53:47 +0400
From: Ilya Matveychikov <[email protected]>
To: [email protected]
Cc: [email protected]
Subject: [PATCH] cmdline: fix get_options() overflow while parsing ranges
When using get_options() it's possible to specify a range of numbers, like 1-100500. The problem is that it doesn't track array size while calling internally to get_range() which iterates over the range and fills the memory with numbers.
Signed-off-by Ilya V. Matveychikov <[email protected]>
--- lib/cmdline.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/cmdline.c +3 -3
@@ -22,14 +22,14 @@* the values[M, M+1, ..., N] into the ints array in get_options. */ -static int get_range (char **str,int *pint) +static int get_range (char **str,int *pint,int n) {int x, inc_counter, upper_range; (*str)++; upper_range =simple_strtol ((*str),NULL ,0 ); inc_counter = upper_range - *pint; -for (x = *pint; x < upper_range; x++) +for (x = *pint; n && x < upper_range; x++, n--) *pint++ = x;return inc_counter; }
@@ -96,7 +96,7 @@ char *get_options(const char *str, int nints, int *ints)break ;if (res ==3 ) {int range_nums; - range_nums =get_range ((char **)&str, ints + i); + range_nums =get_range ((char **)&str, ints + i, nints - i);if (range_nums <0 )break ;/*
Signature · 1 line
2.7.4