* [PATCH] ipr: fix out-of-bounds null overwrite
@ 2016-01-06 4:14 Insu Yun
2016-01-06 5:01 ` Seymour, Shane M
0 siblings, 1 reply; 2+ messages in thread
From: Insu Yun @ 2016-01-06 4:14 UTC (permalink / raw)
To: brking, JBottomley, martin.petersen, linux-scsi, linux-kernel
Cc: taesoo, yeongjin.jang, insu, changwoo, Insu Yun
Return value of snprintf is not bound by size value, 2nd argument.
(https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html).
Return value is number of printed chars, can be larger than 2nd argument.
Therefore, it can write null byte out of bounds ofbuffer.
Since snprintf puts null, it does not need to put additional null byte.
Signed-off-by: Insu Yun <wuninsu@gmail.com>
---
drivers/scsi/ipr.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 536cd5a..b7c3b1a 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4009,7 +4009,6 @@ static ssize_t ipr_store_update_fw(struct device *dev,
return -EACCES;
len = snprintf(fname, 99, "%s", buf);
- fname[len-1] = '\0';
if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname);
--
1.9.1
^ permalink raw reply [flat|nested] 2+ messages in thread* RE: [PATCH] ipr: fix out-of-bounds null overwrite
2016-01-06 4:14 [PATCH] ipr: fix out-of-bounds null overwrite Insu Yun
@ 2016-01-06 5:01 ` Seymour, Shane M
0 siblings, 0 replies; 2+ messages in thread
From: Seymour, Shane M @ 2016-01-06 5:01 UTC (permalink / raw)
To: Insu Yun, brking, JBottomley, martin.petersen, linux-scsi, linux-kernel
Cc: taesoo, yeongjin.jang, insu, changwoo
> len = snprintf(fname, 99, "%s", buf);
> - fname[len-1] = '\0';
Since it appears that's the only time len is actually used in that function can
you please remove the variable len completely as part of the patch?
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-01-06 5:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-06 4:14 [PATCH] ipr: fix out-of-bounds null overwrite Insu Yun
2016-01-06 5:01 ` Seymour, Shane M
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®