From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:48918 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751237AbcBLVAr (ORCPT ); Fri, 12 Feb 2016 16:00:47 -0500 Subject: Patch "lib/hexdump.c: truncate output in case of overflow" has been added to the 4.3-stable tree To: andriy.shevchenko@linux.intel.com, aaro.koskinen@nokia.com, akpm@linux-foundation.org, catalin.marinas@arm.com, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, viro@zeniv.linux.org.uk Cc: , From: Date: Fri, 12 Feb 2016 13:00:46 -0800 Message-ID: <1455310846158174@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled lib/hexdump.c: truncate output in case of overflow to the 4.3-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: lib-hexdump.c-truncate-output-in-case-of-overflow.patch and it can be found in the queue-4.3 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 9f029f540c2f7e010e4922d44ba0dfd05da79f88 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Fri, 6 Nov 2015 16:31:31 -0800 Subject: lib/hexdump.c: truncate output in case of overflow From: Andy Shevchenko commit 9f029f540c2f7e010e4922d44ba0dfd05da79f88 upstream. There is a classical off-by-one error in case when we try to place, for example, 1+1 bytes as hex in the buffer of size 6. The expected result is to get an output truncated, but in the reality we get 6 bytes filed followed by terminating NUL. Change the logic how we fill the output in case of byte dumping into limited space. This will follow the snprintf() behaviour by truncating output even on half bytes. Fixes: 114fc1afb2de (hexdump: make it return number of bytes placed in buffer) Signed-off-by: Andy Shevchenko Reported-by: Aaro Koskinen Tested-by: Aaro Koskinen Cc: Al Viro Cc: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- lib/hexdump.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -169,11 +169,15 @@ int hex_dump_to_buffer(const void *buf, } } else { for (j = 0; j < len; j++) { - if (linebuflen < lx + 3) + if (linebuflen < lx + 2) goto overflow2; ch = ptr[j]; linebuf[lx++] = hex_asc_hi(ch); + if (linebuflen < lx + 2) + goto overflow2; linebuf[lx++] = hex_asc_lo(ch); + if (linebuflen < lx + 2) + goto overflow2; linebuf[lx++] = ' '; } if (j) Patches currently in stable-queue which might be from andriy.shevchenko@linux.intel.com are queue-4.3/lib-hexdump.c-truncate-output-in-case-of-overflow.patch