| Message ID | 20130916233720.GA3967@www.outflux.net (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Mon, 2013-09-16 at 16:37 -0700, Kees Cook wrote: > Make sure that a format string cannot accidentally leak into the printk > buffer. [] > diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c [] > @@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si > b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */ > if (*b == '~') { > b++; > - dprintk(b); > + dprintk("%s", b); > } else > dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>"); > return 1; This looks odd. Perhaps this should be: if (*b == '~') b++; dprintk("etc...); It'd be nice to fix the <empty> typo too. -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Sep 16, 2013 at 7:48 PM, Joe Perches <joe@perches.com> wrote: > On Mon, 2013-09-16 at 16:37 -0700, Kees Cook wrote: >> Make sure that a format string cannot accidentally leak into the printk >> buffer. > [] >> diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c > [] >> @@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si >> b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */ >> if (*b == '~') { >> b++; >> - dprintk(b); >> + dprintk("%s", b); >> } else >> dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>"); >> return 1; > > This looks odd. > > Perhaps this should be: > > if (*b == '~') > b++; > dprintk("etc...); > > It'd be nice to fix the <empty> typo too. This *does* look odd, I agree. Meanwhile, I do believe this patch leaves things better than before. I'm going to merge Kees' patch for now, but it would be nice to see a better cleanup for that code block. -Mike Krufky -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c index 6201c59..61b2cfe 100644 --- a/drivers/media/dvb-frontends/dib9000.c +++ b/drivers/media/dvb-frontends/dib9000.c @@ -649,7 +649,7 @@ static int dib9000_risc_debug_buf(struct dib9000_state *state, u16 * data, u8 si b[2 * (size - 2) - 1] = '\0'; /* Bullet proof the buffer */ if (*b == '~') { b++; - dprintk(b); + dprintk("%s", b); } else dprintk("RISC%d: %d.%04d %s", state->fe_id, ts / 10000, ts % 10000, *b ? b : "<emtpy>"); return 1;
Make sure that a format string cannot accidentally leak into the printk buffer. Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/media/dvb-frontends/dib9000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)