From patchwork Thu Aug 3 07:28:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= X-Patchwork-Id: 13339369 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A8A7C04E69 for ; Thu, 3 Aug 2023 07:29:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233700AbjHCH3A (ORCPT ); Thu, 3 Aug 2023 03:29:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232240AbjHCH2y (ORCPT ); Thu, 3 Aug 2023 03:28:54 -0400 Received: from todd.t-8ch.de (todd.t-8ch.de [IPv6:2a01:4f8:c010:41de::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BEBCA30DB; Thu, 3 Aug 2023 00:28:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=weissschuh.net; s=mail; t=1691047729; bh=EWfkz4+JzA39y3BqrykKODSeqlkEjyKnDKBLfiY+GuE=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=Ig/AE/KgUWfFxj21F5PavNG2qCm5JBdo5042nfha90GMAczwMIY/O9NlmvnbZ3knW EYEIYxbeaLYAtO44FmwMBEp0S1ZD63RBN6MlSBjfWdy+2tRezwF3ocvxK5Tix/jYyu Neftr8nUENgEomhNYVegLkI+kIsTnJPG2mMrsehw= From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= Date: Thu, 03 Aug 2023 09:28:56 +0200 Subject: [PATCH v3 12/14] selftests/nolibc: prevent out of bounds access in expect_vfprintf MIME-Version: 1.0 Message-Id: <20230803-nolibc-warnings-v3-12-bcc1a096ae02@weissschuh.net> References: <20230803-nolibc-warnings-v3-0-bcc1a096ae02@weissschuh.net> In-Reply-To: <20230803-nolibc-warnings-v3-0-bcc1a096ae02@weissschuh.net> To: Willy Tarreau , Shuah Khan Cc: linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Yuan Tan , Zhangjin Wu , =?utf-8?q?Thomas_Wei=C3=9Fschuh?= X-Mailer: b4 0.12.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1691047727; l=1067; i=linux@weissschuh.net; s=20221212; h=from:subject:message-id; bh=EWfkz4+JzA39y3BqrykKODSeqlkEjyKnDKBLfiY+GuE=; b=gJ18WhH9OWXlk9KTnh/w/CexA9VLB/UrRUJQFDwfWfARdOCmeWSBQgfbsGXRx1smLI4+Fcbre zkHVNQjYOHjCWMsimBUOfvx+Y+h5C9RE2QBpLg8ZUpLIRN+YKslVwht X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=KcycQgFPX2wGR5azS7RhpBqedglOZVgRPfdFSPB1LNw= Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org If read() fails and returns -1 (or returns garbage for some other reason) buf would be accessed out of bounds. Only use the return value of read() after it has been validated. Signed-off-by: Thomas Weißschuh --- tools/testing/selftests/nolibc/nolibc-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c index 63f09800057d..0145a44af990 100644 --- a/tools/testing/selftests/nolibc/nolibc-test.c +++ b/tools/testing/selftests/nolibc/nolibc-test.c @@ -1055,7 +1055,6 @@ static int expect_vfprintf(int llen, int c, const char *expected, const char *fm lseek(fd, 0, SEEK_SET); r = read(fd, buf, sizeof(buf) - 1); - buf[r] = '\0'; fclose(memfile); @@ -1065,6 +1064,7 @@ static int expect_vfprintf(int llen, int c, const char *expected, const char *fm return 1; } + buf[r] = '\0'; llen += printf(" \"%s\" = \"%s\"", expected, buf); ret = strncmp(expected, buf, c);