lkml.org 
[lkml]   [2020]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
From
Date
On 2020/7/29 16:11, Jiri Slaby wrote:
> But the loop checks for the overflow:
> if (vgacon_scrollback_cur->tail >= vgacon_scrollback_cur->size)
> vgacon_scrollback_cur->tail = 0;
>
> So the first 2 iterations would write to the end of the buffer and this
> 3rd one should have zeroed ->tail.

In the 2nd iteration before the check:
vgacon_scrollback_cur->tail is 65360 which is still less then
vgacon_scrollback_cur->size(65440), so the ->tail won't be zeroed.

Then it gose to the 3rd iteration, overflow occurs.

Regards,
Yunhai Zhang / NSFOCUS Security Team




\
 
 \ /
  Last update: 2020-07-29 10:19    [W:0.037 / U:0.632 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site