Skip to contentSkip to conversation

: fix possible buffer overflow problem in promlib

PATCH In review Juan Quintela 4 participants 6 messages Jan 2, 2003 – Jan 3, 2003 MIPS

lore
Share & tools
lore

Juan Quintela

author
#0 lore raw

PATCH 1/1 : fix possible buffer overflow problem in promlib

Hi
as the issue about prom.h is still not clear, please aply the trivial part.

32 and 64 bits patch.

Later, Juan.

Index: arch/mips64/lib/promlib.c
===================================================================
RCS file: /home/cvs/linux/arch/mips64/lib/promlib.c,v retrieving revision 1.1.2.1

mips64/lib/promlib.c +8 -2
diff -u -r1.1.2.1 promlib.c
@@ -1,13 +1,19 @@
+
+
+#include <linux/kernel.h>
+
 #include <stdarg.h>
 
+#define BUFSIZE 1024
+
 void prom_printf(char *fmt, ...)
 {
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];
 	char *bptr;
 
 	va_start(args, fmt);
-	vsprintf(ppbuf, fmt, args);
+	vsnprintf(ppbuf, BUFSIZE, fmt, args);
 
 	bptr = ppbuf;

Index: arch/mips/lib/promlib.c
===================================================================
RCS file: /home/cvs/linux/arch/mips/lib/promlib.c,v retrieving revision 1.1.2.1

mips/lib/promlib.c +8 -2
diff -u -r1.1.2.1 promlib.c
@@ -1,13 +1,19 @@
+
+
+#include <linux/kernel.h>
+
 #include <stdarg.h>
 
+#define BUFSIZE 1024
+
 void prom_printf(char *fmt, ...)
 {
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];
 	char *bptr;
 
 	va_start(args, fmt);
-	vsprintf(ppbuf, fmt, args);
+	vsnprintf(ppbuf, BUFSIZE, fmt, args);
 
 	bptr = ppbuf;
Signature · 2 lines
In theory, practice and theory are the same, but in practice they 
are different -- Larry McVoy
#1 lore raw

mips64/lib/promlib.c line 12

Quoted 8 lines · Juan Quintela

as the issue about prom.h is still not clear, please aply the trivial part.

void prom_printf(char *fmt, ...)
{

mips64/lib/promlib.c +1 -1
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];

What about making ppbuf static, to reduce stack usage?

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]

In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

#2 lore raw
Quoted 11 lines · Geert Uytterhoeven

mips64/lib/promlib.c line 12

Quoted 8 lines · Juan Quintela

as the issue about prom.h is still not clear, please aply the trivial part.

void prom_printf(char *fmt, ...)
{

mips64/lib/promlib.c +1 -1
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];

What about making ppbuf static, to reduce stack usage?

By the time when prom_printf() is called stack overflow is not really a consideration anymore, something fatal has happened before.

prom_printf() is our own variant of early_print() so eventually should be replaced by that anyway.

Ralf

#3 lore raw
Quoted 14 lines · Ralf Baechle
Quoted 11 lines · Geert Uytterhoeven

mips64/lib/promlib.c line 12

Quoted 8 lines · Juan Quintela

as the issue about prom.h is still not clear, please aply the trivial part.

void prom_printf(char *fmt, ...)
{

mips64/lib/promlib.c +1 -1
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];

What about making ppbuf static, to reduce stack usage?

Quoted 2 lines

By the time when prom_printf() is called stack overflow is not really a consideration anymore, something fatal has happened before.

I don't think printing e.g. "LINUX started..." indicates something fatal. :-)

Thiemo

#4 lore raw
Quoted 6 lines · Thiemo Seufer
Quoted 4 lines
Quoted 1 line

What about making ppbuf static, to reduce stack usage?

By the time when prom_printf() is called stack overflow is not really a consideration anymore, something fatal has happened before.

I don't think printing e.g. "LINUX started..." indicates something fatal. :-)

So use printk :-)

Ralf

#5 lore raw
Quoted 10 lines · Ralf Baechle
Quoted 6 lines · Thiemo Seufer
Quoted 4 lines
Quoted 1 line

What about making ppbuf static, to reduce stack usage?

By the time when prom_printf() is called stack overflow is not really a consideration anymore, something fatal has happened before.

I don't think printing e.g. "LINUX started..." indicates something fatal. :-)

So use printk :-)

printk might not be ready at that time. I grepped the example from arch/mips/mips-boards/generic/init.c, and there are some more occurences in arch/mips which seem to be non-fatal.

Thiemo