Re: [PATCH] TPM: get_event_name stack corruption

[James Morris]

On Wed, 13 May 2009, Eric Paris wrote:

> get_event_name uses sprintf to fill a buffer declared on the stack.  It fills
> the buffer 2 bytes at a time.  What the code doesn't take into account is that
> sprintf(buf, "%02x", data) actually writes 3 bytes.  2 bytes for the data and
> then it nul terminates the string.  Since we declare buf to be 40 characters
> long and then we write 40 bytes of data into buf sprintf is going to write 41
> characters.  The fix is to leave room in buf for the nul terminator.
> 
> Signed-off-by: Eric Paris <eparis@xxxxxxxxxx>

Applied to 
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

> ---
> 
>  drivers/char/tpm/tpm_bios.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
> index ed306eb..0c2f55a 100644
> --- a/drivers/char/tpm/tpm_bios.c
> +++ b/drivers/char/tpm/tpm_bios.c
> @@ -212,7 +212,8 @@ static int get_event_name(char *dest, struct tcpa_event *event,
>  			unsigned char * event_entry)
>  {
>  	const char *name = "";
> -	char data[40] = "";
> +	/* 41 so there is room for 40 data and 1 nul */
> +	char data[41] = "";
>  	int i, n_len = 0, d_len = 0;
>  	struct tcpa_pc_event *pc_event;
>  
> 

-- 
James Morris
<jmorris@xxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/