* [RESEND. PATCH] dev/parport: fix the array out-of-bounds risk
@ 2024-06-17 1:21 tuhaowen
0 siblings, 0 replies; only message in thread
From: tuhaowen @ 2024-06-17 1:21 UTC (permalink / raw)
To: sudipm.mukherjee; +Cc: linux-kernel, huangbibo, wangyuli, tuhaowen
The array buffer size is 20 bytes.
When executing code in a 64-bit CPU environment, up to 42 bytes of
data will be written into this array
(the size of "%lu\t%lu\n" is 20 +1 + 20 + 1).
In fact, this line of code for 32-bit CPUs also has the risk of
crossing the boundary, but it can exceed 2 bytes at most. With good
luck, it is local variables that are damaged, and there are no serious
consequences.
Signed-off-by: tuhaowen <tuhaowen@uniontech.com>
---
drivers/parport/procfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
index bd388560ed59..9f501d5fa1ec 100644
--- a/drivers/parport/procfs.c
+++ b/drivers/parport/procfs.c
@@ -117,7 +117,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write,
void *result, size_t *lenp, loff_t *ppos)
{
struct parport *port = (struct parport *)table->extra1;
- char buffer[20];
+ char buffer[64];
int len = 0;
if (*ppos) {
--
2.20.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-06-17 1:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-06-17 1:21 [RESEND. PATCH] dev/parport: fix the array out-of-bounds risk tuhaowen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®