Re: [PATCH v2 0/2] ACPI: battery: Fix various string handling issues

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am 19.01.23 um 15:21 schrieb Armin Wolf:

On my Dell Inspiron 3505, the battery model name was displayed
differently than when running Windows. While i first suspected an
ACPI issue, it turned out that the real reason was the ACPI battery
driver failing to handle strings larger than 32 bytes.

This caused the model name of the battery (35 bytes long, hex string)
to miss proper NUL-termination, resulting in a buffer overread later.
Luckily, a valid string was stored right after the now invalid string,
appending only the battery serial number to the original model name.

The first patch fixes a potential buffer overread then handling buffers,
while the second patch finally increases the maximum string length to
avoid truncating such larger strings.

The patch series was tested on a Dell Inspiron 3505 and appears
to work properly.

Are there any outstanding issues with the patch series which need
to be fixed for mainline inclusion?

Armin Wolf

---
Changes in v2:
- Drop first patch since it was already applied
- combine the second and third patch
- do not replace 0 with '\0'
- spell ACPI in capitals
- rework the buffer length hdanling

Armin Wolf (2):
   ACPI: battery: Fix buffer overread if not NUL-terminated
   ACPI: battery: Increase maximum string length

  drivers/acpi/battery.c | 35 +++++++++++++++++++++++------------
  1 file changed, 23 insertions(+), 12 deletions(-)

--
2.30.2





[Index of Archives]     [Linux IBM ACPI]     [Linux Power Management]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]     [Linux Resources]
  Powered by Linux