kernel: crashlog: Avoid out-of-bounds write
authorFelix Fietkau <nbd@openwrt.org>
Wed, 21 Aug 2013 20:59:25 +0000 (20:59 +0000)
committerFelix Fietkau <nbd@openwrt.org>
Wed, 21 Aug 2013 20:59:25 +0000 (20:59 +0000)
commit3848e6a246192d42160034e106f838b791931dce
tree3749a5663d177b71497810db03192b740aef1328
parent3e28d0849ee6cd39bfcc1a3458881b1e5e09c75c
kernel: crashlog: Avoid out-of-bounds write

vsnprintf returns the number of chars that would have been written, not
the actual number of chars written. This can lead to crashlog_buf->len
being too big which in turn can lead to get_maxlen() returning negative
numbers. The length argument of kmsg_dump_get_buffer will be casted to
a size_t which makes a negative input a big positive number allowing
kmsg_dump_get_buffer to write out of bounds.

Fix this by using vscnprintf which returns the actually written number
of chars.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
SVN-Revision: 37820
target/linux/generic/patches-3.10/930-crashlog.patch
target/linux/generic/patches-3.3/930-crashlog.patch
target/linux/generic/patches-3.6/930-crashlog.patch
target/linux/generic/patches-3.8/930-crashlog.patch
target/linux/generic/patches-3.9/930-crashlog.patch