lkml.org 
[lkml]   [2013]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] tty vt: fix character insertion overflow
On Sun, 24 Feb 2013 20:06:09 -0500 (EST)
Nicolas Pitre <nicolas.pitre@linaro.org> wrote:

> Commit 81732c3b2f (tty vt: Fix line garbage in virtual console on
> command line edition) broke insert_char() in multiple ways. Then
> commit b1a925f44a (tty vt: Fix a regression in command line edition)
> partially fixed it. However, the buffer being moved is still too large
> and overflowing beyond the end of the current line, corrupting existing
> characters on the next line.

and

> One detail I didn't mention explicitly is that the cursor can be moved
> to the last screen line, and then the sequence ESC [ <n> @ is all that
> is needed to shovel 2*n bytes from that bottom screen line into adjacent
> memory which could potentially be exploited in some way.

You are right, this bug is critical. Sorry.

Acked-by: Jean-François Moine <moinejf@free.fr>

--
Ken ar c'hentañ | ** Breizh ha Linux atav! **
Jef | http://moinejf.free.fr/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2013-02-25 10:21    [W:0.053 / U:0.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site