Re: [PATCH] kconfig: Avoid buffer underrun in choice input

[Ben Hutchings <ben@decadent.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1404 bytes --]

On Sat, 2011-03-19 at 04:26 +0000, Ben Hutchings wrote:
> commit 40aee729b350672c2550640622416a855e27938f ('kconfig: fix default
> value for choice input') fixed some cases where kconfig would select
> the wrong option from a choice with a single valid option and thus
> enter an infinite loop.
> 
> However, this broke the test for user input of the form 'N?', because
> when kconfig selects the single valid option the input is zero-length
> and the test will read the byte before the input buffer.  If this
> happens to contain '?' (as it will in a mips build on Debian unstable
> today) then kconfig again enters an infinite loop.

Please acknowledge this and send it upstream.

Ben.

> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: stable@kernel.org [2.6.17+]
> ---
>  scripts/kconfig/conf.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
> index 659326c..006ad81 100644
> --- a/scripts/kconfig/conf.c
> +++ b/scripts/kconfig/conf.c
> @@ -332,7 +332,7 @@ static int conf_choice(struct menu *menu)
>  		}
>  		if (!child)
>  			continue;
> -		if (line[strlen(line) - 1] == '?') {
> +		if (line[0] && line[strlen(line) - 1] == '?') {
>  			print_help(child);
>  			continue;
>  		}

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]