* [PATCH] dvb: fix potential format string leak
@ 2013-09-16 23:37 Kees Cook
2013-09-16 23:48 ` Joe Perches
0 siblings, 1 reply; 3+ messages in thread
From: Kees Cook @ 2013-09-16 23:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Mauro Carvalho Chehab, linux-media
Make sure that a format string cannot accidentally leak into the printk
buffer.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/media/dvb-frontends/dib9000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c
index 6201c59..61b2cfe 100644
--- a/drivers/media/dvb-frontends/dib9000.c
+++ b/drivers/media/dvb-frontends/dib9000.c
@@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si
b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */
if (*b == '~') {
b++;
- dprintk(b);
+ dprintk("%s", b);
} else
dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>");
return 1;
--
1.7.9.5
--
Kees Cook
Chrome OS Security
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] dvb: fix potential format string leak
2013-09-16 23:37 [PATCH] dvb: fix potential format string leak Kees Cook
@ 2013-09-16 23:48 ` Joe Perches
2013-09-30 16:20 ` Michael Krufky
0 siblings, 1 reply; 3+ messages in thread
From: Joe Perches @ 2013-09-16 23:48 UTC (permalink / raw)
To: Kees Cook; +Cc: linux-kernel, Mauro Carvalho Chehab, linux-media
On Mon, 2013-09-16 at 16:37 -0700, Kees Cook wrote:
> Make sure that a format string cannot accidentally leak into the printk
> buffer.
[]
> diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c
[]
> @@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si
> b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */
> if (*b == '~') {
> b++;
> - dprintk(b);
> + dprintk("%s", b);
> } else
> dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>");
> return 1;
This looks odd.
Perhaps this should be:
if (*b == '~')
b++;
dprintk("etc...);
It'd be nice to fix the <empty> typo too.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] dvb: fix potential format string leak
2013-09-16 23:48 ` Joe Perches
@ 2013-09-30 16:20 ` Michael Krufky
0 siblings, 0 replies; 3+ messages in thread
From: Michael Krufky @ 2013-09-30 16:20 UTC (permalink / raw)
To: Joe Perches; +Cc: Kees Cook, LKML, Mauro Carvalho Chehab, linux-media
On Mon, Sep 16, 2013 at 7:48 PM, Joe Perches <joe@perches.com> wrote:
> On Mon, 2013-09-16 at 16:37 -0700, Kees Cook wrote:
>> Make sure that a format string cannot accidentally leak into the printk
>> buffer.
> []
>> diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c
> []
>> @@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si
>> b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */
>> if (*b == '~') {
>> b++;
>> - dprintk(b);
>> + dprintk("%s", b);
>> } else
>> dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>");
>> return 1;
>
> This looks odd.
>
> Perhaps this should be:
>
> if (*b == '~')
> b++;
> dprintk("etc...);
>
> It'd be nice to fix the <empty> typo too.
This *does* look odd, I agree. Meanwhile, I do believe this patch
leaves things better than before. I'm going to merge Kees' patch for
now, but it would be nice to see a better cleanup for that code block.
-Mike Krufky
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-09-30 16:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-16 23:37 [PATCH] dvb: fix potential format string leak Kees Cook
2013-09-16 23:48 ` Joe Perches
2013-09-30 16:20 ` Michael Krufky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox