On Wed, 2018-10-03 at 17:01 -0700, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@xxxxxxxxxx>
>
> The 12 character temporary buffer is not necessarily long enough to hold
> a 'long' value. Increase it.
>
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> ---
> security/integrity/ima/ima_fs.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index ae9d5c766a3ce..4b50fe9c18edd 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -42,14 +42,15 @@ static int __init default_canonical_fmt_setup(char *str)
> __setup("ima_canonical_fmt", default_canonical_fmt_setup);
>
> static int valid_policy = 1;
> -#define TMPBUFLEN 12
> +
> static ssize_t ima_show_htable_value(char __user *buf, size_t count,
> loff_t *ppos, atomic_long_t *val)
> {
> - char tmpbuf[TMPBUFLEN];
> + /* temporary buffer that is plenty long enough */
> + char tmpbuf[32];
If the maximum value of long is 9,223,372,036,854,775,807, the largest
string needed to represent this value is 20 characters. Should 32 be
hardcoded like this?
Mimi
> ssize_t len;
>
> - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
> + len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val));
> return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
> }
>
