kernel: crashlog: Avoid out-of-bounds write

vsnprintf returns the number of chars that would have been written, not
the actual number of chars written. This can lead to crashlog_buf->len
being too big which in turn can lead to get_maxlen() returning negative
numbers. The length argument of kmsg_dump_get_buffer will be casted to
a size_t which makes a negative input a big positive number allowing
kmsg_dump_get_buffer to write out of bounds.

Fix this by using vscnprintf which returns the actually written number
of chars.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>

SVN-Revision: 37820
owl
Felix Fietkau 2013-08-21 20:59:25 +00:00
parent 3e28d0849e
commit 3848e6a246
5 changed files with 5 additions and 5 deletions

View File

@ -166,7 +166,7 @@
+ return;
+
+ va_start(args, fmt);
+ crashlog_buf->len += vsnprintf(
+ crashlog_buf->len += vscnprintf(
+ &crashlog_buf->data[crashlog_buf->len],
+ len, fmt, args);
+ va_end(args);

View File

@ -166,7 +166,7 @@
+ return;
+
+ va_start(args, fmt);
+ crashlog_buf->len += vsnprintf(
+ crashlog_buf->len += vscnprintf(
+ &crashlog_buf->data[crashlog_buf->len],
+ len, fmt, args);
+ va_end(args);

View File

@ -166,7 +166,7 @@
+ return;
+
+ va_start(args, fmt);
+ crashlog_buf->len += vsnprintf(
+ crashlog_buf->len += vscnprintf(
+ &crashlog_buf->data[crashlog_buf->len],
+ len, fmt, args);
+ va_end(args);

View File

@ -166,7 +166,7 @@
+ return;
+
+ va_start(args, fmt);
+ crashlog_buf->len += vsnprintf(
+ crashlog_buf->len += vscnprintf(
+ &crashlog_buf->data[crashlog_buf->len],
+ len, fmt, args);
+ va_end(args);

View File

@ -166,7 +166,7 @@
+ return;
+
+ va_start(args, fmt);
+ crashlog_buf->len += vsnprintf(
+ crashlog_buf->len += vscnprintf(
+ &crashlog_buf->data[crashlog_buf->len],
+ len, fmt, args);
+ va_end(args);