Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1306292

Re: [PATCH] efi: fix out-of-bounds null overwrite vulnerability

Show all headers | View raw

On Fri, 08 Jan, at 04:47:17PM, Luck, Tony wrote:
> > But this function doesn't use snprintf(), it uses scnprintf() which
> > returns the number of characters written into buf and, because
> > scnprintf() largely follows vnsprintf(), it will never write more than
> > 'size' bytes into the buffer.
> 
>         if (bank && device)
>                 n = snprintf(msg, len, "DIMM location: %s %s ", bank, device);
> 
> That looks like "snprintf", not "scnprintf" to me :-)
 
Oops! Can you believe I looked at the wrong function?

> What about using:
> 
> 	msg[len] = '\0';
> 
> to guarantee NUL termination?

But that may leave garbage bytes in 'rcd_decode_str' in the case where
the string isn't as long as 'len'.

How about memset()'ing the buffer to zero and deleting the NUL
termination line?

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] efi: fix out-of-bounds null overwrite vulnerability Insu Yun <wuninsu@gmail.com> - 2016-01-07 20:10 +0100
  Re: [PATCH] efi: fix out-of-bounds null overwrite vulnerability Matt Fleming <matt@codeblueprint.co.uk> - 2016-01-08 11:20 +0100
    RE: [PATCH] efi: fix out-of-bounds null overwrite vulnerability "Luck, Tony" <tony.luck@intel.com> - 2016-01-08 17:50 +0100
      Re: [PATCH] efi: fix out-of-bounds null overwrite vulnerability Matt Fleming <matt@codeblueprint.co.uk> - 2016-01-11 15:20 +0100
        RE: [PATCH] efi: fix out-of-bounds null overwrite vulnerability "Luck, Tony" <tony.luck@intel.com> - 2016-01-11 19:20 +0100
          Re: [PATCH] efi: fix out-of-bounds null overwrite vulnerability Matt Fleming <matt@codeblueprint.co.uk> - 2016-01-14 12:20 +0100
            Re: [PATCH] efi: fix out-of-bounds null overwrite vulnerability Tony Luck <tony.luck@gmail.com> - 2016-01-15 03:10 +0100

csiph-web