* [PATCH] kernel/kexec.c: use vscnprintf() instead of vsnprintf() in vmcoreinfo_append_str()
@ 2013-10-09 8:29 Chen Gang
0 siblings, 0 replies; only message in thread
From: Chen Gang @ 2013-10-09 8:29 UTC (permalink / raw)
To: Eric W. Biederman
Cc: Richard Weinberger, kexec, linux-kernel@vger.kernel.org, Al Viro,
Joe Perches, Andrew Morton
vsnprintf() may let 'r' larger than sizeof(buf), in this case, if 'r'
is also less than "vmcoreinfo_max_size - vmcoreinfo_size" (left size of
destination buffer), next memcpy() will read the unexpected addresses.
Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
kernel/kexec.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 2a74f30..0abcd68 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1533,7 +1533,7 @@ void vmcoreinfo_append_str(const char *fmt, ...)
size_t r;
va_start(args, fmt);
- r = vsnprintf(buf, sizeof(buf), fmt, args);
+ r = vscnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
r = min(r, vmcoreinfo_max_size - vmcoreinfo_size);
--
1.7.7.6
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-10-09 8:30 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-09 8:29 [PATCH] kernel/kexec.c: use vscnprintf() instead of vsnprintf() in vmcoreinfo_append_str() Chen Gang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox