long PCI names buffer overflow

From: Geert Uytterhoeven (geert@linux-m68k.org)
Date: Mon Mar 20 2000 - 05:27:14 EST

pci_name_device() (at least in 2.3.99-pre2) overwrites innocent data in struct
pci_dev if the sum of the lengths of the vendor and device names are longer
than 47 characters. Examples are:

    Digital Equipment Corporation DECchip 21140 [FasterNet]
    Digital Equipment Corporation DECchip 21140 [FasterNet] (#2)
    Acer Laboratories Inc. [ALi] M1533 PCI to ISA Bridge [Aladdin IV]

Unfortunately the kernel doesn't have snprintf() yet, and updating vsprintf()
for bounds looks quite clumsy. Using strncpy() and strncat() is possible here
but would be rather complex for the case where only the vendor ID is
recognized.

Gr{oetje,eeting}s,

                                                Geert 

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Thu Mar 23 2000 - 21:00:29 EST