From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754685AbdL2BDc (ORCPT <rfc822;w@1wt.eu>);
        Thu, 28 Dec 2017 20:03:32 -0500
Received: from mail.kernel.org ([198.145.29.99]:58058 "EHLO mail.kernel.org"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1753427AbdL2BDb (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 28 Dec 2017 20:03:31 -0500
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0417A20671
Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=goodmis.org
Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=rostedt@goodmis.org
Date: Thu, 28 Dec 2017 20:03:28 -0500
From: Steven Rostedt <rostedt@goodmis.org>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Andrew Morton <akpm@linux-foundation.org>,
        Frederic Weisbecker <fweisbec@gmail.com>
Subject: Re: [RFC][PATCH] vsprintf: Do not have bprintf dereference pointers
Message-ID: <20171228200328.57b6c2fa@gandalf.local.home>
In-Reply-To: <20171228185026.17ff7b7d@gandalf.local.home>
References: <20171228185026.17ff7b7d@gandalf.local.home>
X-Mailer: Claws Mail 3.14.0 (GTK+ 2.24.31; x86_64-pc-linux-gnu)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, 28 Dec 2017 18:50:26 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:

> +			default:
> +				if (!isalnum(*fmt)) {
> +					process = true;
> +					break;
> +				}
> +				/* Pointer dereference was already processed */
> +				if (str < end) {
> +					len = copy = strlen(args);
> +					if (copy > end - str)
> +						copy = end - str;
> +					memcpy(str, args, copy);
> +					str += copy;

Actually, that should have been: str += len; as str will be used to
return the amount that would be processed, even if the size wasn't long
enough.

V2 coming up.

-- Steve

> +					args += len;
> +				}
> +			}