lkml.org 
[lkml]   [2019]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v6 9/9] vsprintf: Avoid confusion between invalid address and value
    On (02/08/19 16:23), Petr Mladek wrote:
    [..]
    > Plain Pointers
    > --------------
    > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
    > index 3a95b4d1ca2e..e51cbc2be540 100644
    > --- a/lib/vsprintf.c
    > +++ b/lib/vsprintf.c
    > @@ -1510,7 +1510,7 @@ char *ip_addr_string(char *buf, char *end, const void *ptr,
    > case AF_INET6:
    > return ip6_addr_string_sa(buf, end, &sa->v6, spec, fmt);
    > default:
    > - return string_nocheck(buf, end, "(invalid address)", spec);
    > + return string_nocheck(buf, end, "(einval)", spec);
    > }}

    Hmm... The original code looks "a bit" dangerous.

    Suppose, in my driver I want to sprintf() IPv4 address. The longest
    possible address is 3 * 4 (%d%d%d) + 3 bytes (dots) + terminating NULL.
    E.g. 111.111.111.111

    So I can allocate a 16-bytes buffer (stack or slab) and accidentally
    do an %piS sprintf() on a corrupted in_addr struct:

    char buf[16];
    sprintf(buf, "%piS", in_addr);

    forcing sprintf() to write "(invalid address)" to a 16-bytes buffer,
    but the thing is - strlen("(invalid address)") > 16.


    We might want to take this change out of this series.

    -ss

    \
     
     \ /
      Last update: 2019-02-19 04:05    [W:2.378 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site