From: Jean-Francois Moine <moinejf@free.fr>
To: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] tty vt: fix character insertion overflow
Date: Mon, 25 Feb 2013 09:50:18 +0100 [thread overview]
Message-ID: <20130225095018.387b165e@armhf> (raw)
In-Reply-To: <alpine.LFD.2.03.1302242001070.2213@syhkavp.arg>
On Sun, 24 Feb 2013 20:06:09 -0500 (EST)
Nicolas Pitre <nicolas.pitre@linaro.org> wrote:
> Commit 81732c3b2f (tty vt: Fix line garbage in virtual console on
> command line edition) broke insert_char() in multiple ways. Then
> commit b1a925f44a (tty vt: Fix a regression in command line edition)
> partially fixed it. However, the buffer being moved is still too large
> and overflowing beyond the end of the current line, corrupting existing
> characters on the next line.
and
> One detail I didn't mention explicitly is that the cursor can be moved
> to the last screen line, and then the sequence ESC [ <n> @ is all that
> is needed to shovel 2*n bytes from that bottom screen line into adjacent
> memory which could potentially be exploited in some way.
You are right, this bug is critical. Sorry.
Acked-by: Jean-François Moine <moinejf@free.fr>
--
Ken ar c'hentañ | ** Breizh ha Linux atav! **
Jef | http://moinejf.free.fr/
prev parent reply other threads:[~2013-02-25 8:50 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-25 1:06 [PATCH] tty vt: fix character insertion overflow Nicolas Pitre
2013-02-25 8:50 ` Jean-Francois Moine [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130225095018.387b165e@armhf \
--to=moinejf@free.fr \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nicolas.pitre@linaro.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.