Messages in this thread Patch in this message | | | From | Vasiliy Kulikov <> | Subject | [PATCH 3/4] leds: leds-lp5521: fix potential buffer overflow | Date | Thu, 18 Nov 2010 21:17:00 +0300 |
| |
The code doesn't check first sscanf() return value. If first sscanf() failed then c contains some garbage. It might lead to buffer overflow in second sscanf() call.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> --- Compile tested.
drivers/leds/leds-lp5521.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c index 3782f31..939319d 100644 --- a/drivers/leds/leds-lp5521.c +++ b/drivers/leds/leds-lp5521.c @@ -362,6 +362,8 @@ static int lp5521_do_store_load(struct lp5521_engine *engine, while ((offset < len - 1) && (i < LP5521_PROGRAM_LENGTH)) { /* separate sscanfs because length is working only for %s */ ret = sscanf(buf + offset, "%2s%n ", c, &nrchars); + if (ret != 2) + goto fail; ret = sscanf(c, "%2x", &cmd); if (ret != 1) goto fail; -- 1.7.0.4
| |