s390: potential buffer overflow
Subsystems (2)
PATCH 1/1 s390: potential buffer overflow
"len" hasn't been properly range checked so we shouldn't use it as an array offset. This can only be written to by root but it would still be annoying to accidentally write more than 3 characters and corrupt your memory.
---
I don't have a cross compile environment to compile this. Sorry. :/
drivers/s390/char/sclp_async.c +2 -1
@@ -84,7 +84,7 @@ static int proc_handler_callhome(struct ctl_table *ctl, int write, rc =copy_from_user (buf, buffer,sizeof (buf));if (rc !=0 )return -EFAULT ; - buf[len -1 ] ='\0' ; + buf[sizeof (buf) -1 ] ='\0' ;if (strict_strtoul (buf,0 , &val) !=0 )return -EINVAL ;if (val !=0 && val !=1 )
@@ -99,6 +99,7 @@ static int proc_handler_callhome(struct ctl_table *ctl, int write,static struct ctl_table callhome_table[] = { { .procname ="callhome" , + .maxlen =3 , .mode =0644 , .proc_handler = proc_handler_callhome, },
Quoted 23 lines · Dan Carpenter
"len" hasn't been properly range checked so we shouldn't use it as an array offset. This can only be written to by root but it would still be annoying to accidentally write more than 3 characters and corrupt your memory.
Signed-off-by Dan Carpenter <[email protected]>---
I don't have a cross compile environment to compile this. Sorry. :/drivers/s390/char/sclp_async.c +1
-1@@ -84,7 +84,7 @@ static int proc_handler_callhome(struct ctl_table *ctl, int write, rc =copy_from_user (buf, buffer,sizeof (buf));if (rc !=0 )return -EFAULT ; - buf[len -1 ] ='\0' ; + buf[sizeof (buf) -1 ] ='\0' ;if (strict_strtoul (buf,0 , &val) !=0 )return -EINVAL ;if (val !=0 && val !=1 )
drivers/s390/char/sclp_async.c static int proc_handler_callhome(struct ctl_table *ctl, int write, · line 105
Quoted 7 lines
drivers/s390/char/sclp_async.c +1
-0@@ -99,6 +99,7 @@ static int proc_handler_callhome(struct ctl_table *ctl, int write,static struct ctl_table callhome_table[] = { { .procname ="callhome" , + .maxlen =3 , .mode =0644 , .proc_handler = proc_handler_callhome, },
Setting maxlen won't do any good as proc_handler_callhome doesn't look at it.
Eric
PATCH v2 1/1 s390: potential buffer overflow
"len" hasn't been properly range checked so we shouldn't use it as an array offset. This can only be written to by root but it would still be annoying to accidentally write more than 3 characters and corrupt your memory.
---
v2. Removed a superfluous chunk from my first patch. I didn't understand how ->maxlen worked.
drivers/s390/char/sclp_async.c +1 -1
@@ -84,7 +84,7 @@ static int proc_handler_callhome(struct ctl_table *ctl, int write, rc =copy_from_user (buf, buffer,sizeof (buf));if (rc !=0 )return -EFAULT ; - buf[len -1 ] ='\0' ; + buf[sizeof (buf) -1 ] ='\0' ;if (strict_strtoul (buf,0 , &val) !=0 )return -EINVAL ;if (val !=0 && val !=1 )