From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752651AbcAGTFY (ORCPT ); Thu, 7 Jan 2016 14:05:24 -0500 Received: from mail-yk0-f180.google.com ([209.85.160.180]:35408 "EHLO mail-yk0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751060AbcAGTFW (ORCPT ); Thu, 7 Jan 2016 14:05:22 -0500 From: Insu Yun To: matt@codeblueprint.co.uk, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org Cc: taesoo@gatech.edu, yeongjin.jang@gatech.edu, insu@gatech.edu, changwoo@gatech.edu, Insu Yun Subject: [PATCH] efi: fix out-of-bounds null overwrite vulnerability Date: Thu, 7 Jan 2016 14:05:30 -0500 Message-Id: <1452193530-76672-1-git-send-email-wuninsu@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org snprintf's return value is not bound by size value. (https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html) if printed value is larger than buffer size, it can overwrite null byte in out-of-bounds buffer. Signed-off-by: Insu Yun --- drivers/firmware/efi/cper.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c index d425374..77aa75f 100644 --- a/drivers/firmware/efi/cper.c +++ b/drivers/firmware/efi/cper.c @@ -267,7 +267,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) "DIMM location: not present. DMI handle: 0x%.4x ", mem->mem_dev_handle); - msg[n] = '\0'; return n; } -- 1.9.1