lkml.org 
[lkml]   [2013]   [Sep]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/1] staging/speakup/kobjects.c: Code improvement.
Good eye for spotting the memory corruption bug!

This is a bug fix, so the fix should go in a separate patch and not
merged with a code cleanup patch. Ordinary users can trigger this so
it's a security bug and separating it out is extra important.

The checking in spk_set_num_var() is not sufficient as well. If we use
E_INC then we can hit an integer overflow bug:

drivers/staging/speakup/varhandlers.c
198 if (how == E_SET)
199 val = input;
200 else
201 val = var_data->u.n.value;
202 if (how == E_INC)
203 val += input;

"input" comes from the user. This addition can overflow so that input
is a very high number and now "val" is a low enough number.

204 else if (how == E_DEC)
205 val -= input;
206 if (val < var_data->u.n.low || val > var_data->u.n.high)
207 return -ERANGE;

"val" is valid, but "input" is not valid. We use "input" in the caller
function as the index to an array.

208 }

I guess that's simple enough to fix but why is the caller using "input"
instead of "val"?

regards,
dan carpenter



\
 
 \ /
  Last update: 2013-09-11 01:21    [W:0.097 / U:2.684 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site