Messages in this thread | | | Subject | Re: [PATCH] lib: vsprintf: Avoid 32-bit truncation in vsscanf number parsing | From | Richard Fitzgerald <> | Date | Mon, 16 Nov 2020 10:47:37 +0000 |
| |
On 13/11/2020 14:00, Petr Mladek wrote: > On Thu 2020-11-12 12:04:27, Steven Rostedt wrote: >> On Thu, 12 Nov 2020 15:46:46 +0000 >> Richard Fitzgerald <rf@opensource.cirrus.com> wrote: >> >>> See this thread from 2014 where the field width problem was raised and >>> explained: >>> http://lkml.iu.edu/hypermail/linux/kernel/1401.1/03443.html >>> >>> and the reply from Linus Torvalds that was against fixing field width >>> handling: >>> http://lkml.iu.edu/hypermail/linux/kernel/1401.1/03488.html >> >> Thanks for the pointers, but note, that references to older emails should >> use https://lore.kernel.org/ as these links format the output really >> horribly. >> >>> >>> which I assume is why the field handling wasn't unoptimized to be >>> strictly correct. > > Honestly, the handling of the number width by div does not look like > a real optimization to me. It avoids the need of the temporary buffer > by expensive and error-prone operation. > > IMHO, it is safe to assume that the width will be limited so that > the value would never overflow. > > The longest supported number would be (2^64 - 1) in octal. If I am > counting correctly, it is > > 01777777777777777777777 > > and it fits into buf[24] including the trailing '\0'. > > We could call WARN_ON_ONCE() when the width >= 24 is higher. > And we could add a compiler check when long long is bigger > than 64-bit. > >> Yes, but perhaps its time to fix the real problem and not just add >> band-aids. That thread is over 6 years old (the email was from Jan 14, 2014) >> >> $ git diff `git rev-list --before 'Jan 14 2014' HEAD --max-count=1` | >> grep '^+' | grep sscanf | wc -l >> 622 >> >> There's been over 600 new additions of sscanf(). Now is the time to just >> fix it correctly. > > And the following one might suffer from this problem: > > drivers/soundwire/slave.c: ret = sscanf(compat, "sdw%01x%04hx%04hx%02hhx", &sdw_version, >
That's exactly the bug I have. I'll look at reworking the code to handle number field widths properly.
> I agree with Steven that it is time to fix it properly. > > Best Regards, > Petr >
| |