[PATCH]: fix possible buffer overflow problem in promlib

[PATCH]: fix possible buffer overflow problem in promlib

[Juan Quintela]

Hi
        as the issue about prom.h is still not clear, please aply the
        trivial part.

        32 and 64 bits patch.

Later, Juan.

Index: arch/mips64/lib/promlib.c
===================================================================
RCS file: /home/cvs/linux/arch/mips64/lib/promlib.c,v
retrieving revision 1.1.2.1
diff -u -r1.1.2.1 promlib.c
--- arch/mips64/lib/promlib.c	28 Sep 2002 22:28:38 -0000	1.1.2.1
+++ arch/mips64/lib/promlib.c	20 Dec 2002 19:10:45 -0000
@@ -1,13 +1,19 @@
+
+
+#include <linux/kernel.h>
+
 #include <stdarg.h>
 
+#define BUFSIZE 1024
+
 void prom_printf(char *fmt, ...)
 {
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];
 	char *bptr;
 
 	va_start(args, fmt);
-	vsprintf(ppbuf, fmt, args);
+	vsnprintf(ppbuf, BUFSIZE, fmt, args);
 
 	bptr = ppbuf;
 
Index: arch/mips/lib/promlib.c
===================================================================
RCS file: /home/cvs/linux/arch/mips/lib/promlib.c,v
retrieving revision 1.1.2.1
diff -u -r1.1.2.1 promlib.c
--- arch/mips/lib/promlib.c	28 Sep 2002 22:28:38 -0000	1.1.2.1
+++ arch/mips/lib/promlib.c	20 Dec 2002 19:10:43 -0000
@@ -1,13 +1,19 @@
+
+
+#include <linux/kernel.h>
+
 #include <stdarg.h>
 
+#define BUFSIZE 1024
+
 void prom_printf(char *fmt, ...)
 {
 	va_list args;
-	char ppbuf[1024];
+	char ppbuf[BUFSIZE];
 	char *bptr;
 
 	va_start(args, fmt);
-	vsprintf(ppbuf, fmt, args);
+	vsnprintf(ppbuf, BUFSIZE, fmt, args);
 
 	bptr = ppbuf;
 


-- 
In theory, practice and theory are the same, but in practice they 
are different -- Larry McVoy

Re: [PATCH]: fix possible buffer overflow problem in promlib

[Geert Uytterhoeven]

On 2 Jan 2003, Juan Quintela wrote:
>         as the issue about prom.h is still not clear, please aply the
>         trivial part.

>  void prom_printf(char *fmt, ...)
>  {
>  	va_list args;
> -	char ppbuf[1024];
> +	char ppbuf[BUFSIZE];

What about making ppbuf static, to reduce stack usage?

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds

Re: [PATCH]: fix possible buffer overflow problem in promlib

[Ralf Baechle]

On Thu, Jan 02, 2003 at 08:47:49PM +0100, Geert Uytterhoeven wrote:

> On 2 Jan 2003, Juan Quintela wrote:
> >         as the issue about prom.h is still not clear, please aply the
> >         trivial part.
> 
> >  void prom_printf(char *fmt, ...)
> >  {
> >  	va_list args;
> > -	char ppbuf[1024];
> > +	char ppbuf[BUFSIZE];
> 
> What about making ppbuf static, to reduce stack usage?

By the time when prom_printf() is called stack overflow is not really a
consideration anymore, something fatal has happened before.

prom_printf() is our own variant of early_print() so eventually should
be replaced by that anyway.

  Ralf

Re: [PATCH]: fix possible buffer overflow problem in promlib

[Thiemo Seufer]

Ralf Baechle wrote:
> On Thu, Jan 02, 2003 at 08:47:49PM +0100, Geert Uytterhoeven wrote:
> 
> > On 2 Jan 2003, Juan Quintela wrote:
> > >         as the issue about prom.h is still not clear, please aply the
> > >         trivial part.
> > 
> > >  void prom_printf(char *fmt, ...)
> > >  {
> > >  	va_list args;
> > > -	char ppbuf[1024];
> > > +	char ppbuf[BUFSIZE];
> > 
> > What about making ppbuf static, to reduce stack usage?
> 
> By the time when prom_printf() is called stack overflow is not really a
> consideration anymore, something fatal has happened before.

I don't think printing e.g. "LINUX started..." indicates something fatal. :-)


Thiemo

Re: [PATCH]: fix possible buffer overflow problem in promlib

[Ralf Baechle]

On Fri, Jan 03, 2003 at 03:29:56PM +0100, Thiemo Seufer wrote:

> > > What about making ppbuf static, to reduce stack usage?
> > 
> > By the time when prom_printf() is called stack overflow is not really a
> > consideration anymore, something fatal has happened before.
> 
> I don't think printing e.g. "LINUX started..." indicates something fatal. :-)

So use printk :-)

  Ralf

Re: [PATCH]: fix possible buffer overflow problem in promlib

[Thiemo Seufer]

Ralf Baechle wrote:
> On Fri, Jan 03, 2003 at 03:29:56PM +0100, Thiemo Seufer wrote:
> 
> > > > What about making ppbuf static, to reduce stack usage?
> > > 
> > > By the time when prom_printf() is called stack overflow is not really a
> > > consideration anymore, something fatal has happened before.
> > 
> > I don't think printing e.g. "LINUX started..." indicates something fatal. :-)
> 
> So use printk :-)

printk might not be ready at that time. I grepped the example from
arch/mips/mips-boards/generic/init.c, and there are some more
occurences in arch/mips which seem to be non-fatal.


Thiemo