mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [RESEND. PATCH] dev/parport: fix the array out-of-bounds risk
@ 2024-06-17  1:21 tuhaowen
  0 siblings, 0 replies; only message in thread
From: tuhaowen @ 2024-06-17  1:21 UTC (permalink / raw)
  To: sudipm.mukherjee; +Cc: linux-kernel, huangbibo, wangyuli, tuhaowen

The array buffer size is 20 bytes.
When executing code in a 64-bit CPU environment, up to 42 bytes of
data will be written into this array
(the size of "%lu\t%lu\n" is 20 +1 + 20 + 1).

In fact, this line of code for 32-bit CPUs also has the risk of
crossing the boundary, but it can exceed 2 bytes at most. With good
luck, it is local variables that are damaged, and there are no serious
consequences.

Signed-off-by: tuhaowen <tuhaowen@uniontech.com>
---
 drivers/parport/procfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
index bd388560ed59..9f501d5fa1ec 100644
--- a/drivers/parport/procfs.c
+++ b/drivers/parport/procfs.c
@@ -117,7 +117,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write,
 				 void *result, size_t *lenp, loff_t *ppos)
 {
 	struct parport *port = (struct parport *)table->extra1;
-	char buffer[20];
+	char buffer[64];
 	int len = 0;
 
 	if (*ppos) {
-- 
2.20.1


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2024-06-17  1:22 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-06-17  1:21 [RESEND. PATCH] dev/parport: fix the array out-of-bounds risk tuhaowen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®