Messages in this thread | | | Subject | Re: [PATCH] dvb: fix potential format string leak | From | Joe Perches <> | Date | Mon, 16 Sep 2013 16:48:52 -0700 |
| |
On Mon, 2013-09-16 at 16:37 -0700, Kees Cook wrote: > Make sure that a format string cannot accidentally leak into the printk > buffer. [] > diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c [] > @@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si > b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */ > if (*b == '~') { > b++; > - dprintk(b); > + dprintk("%s", b); > } else > dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>"); > return 1;
This looks odd.
Perhaps this should be:
if (*b == '~') b++; dprintk("etc...);
It'd be nice to fix the <empty> typo too.
| |