Kees Cook <keescook@xxxxxxxxxxxx> wrote: > Change snprintf to scnprintf. There are generally two cases where using > snprintf causes problems. > > 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) In this case, > if snprintf would have written more characters than what the buffer > size (SIZE) is, then size will end up larger than SIZE. In later uses > of snprintf, SIZE - size will result in a negative number, leading to > problems. Note that size might already be too large by using size = > snprintf before the code reaches a case of size += snprintf. > > 2) If size is ultimately used as a length parameter for a copy back to > user space, then it will potentially allow for a buffer overflow and > information disclosure when size is greater than SIZE. When the size is > used to index the buffer directly, we can have memory corruption. This > also means when size = snprintf... is used, it may also cause problems > since size may become large. Copying to userspace is mitigated by the > HARDENED_USERCOPY kernel configuration. > > The solution to these issues is to use scnprintf which returns the number > of characters actually written to the buffer, so the size variable will > never exceed SIZE. > > Cc: Willy Tarreau <w@xxxxxx> > Cc: Silvio Cesare <silvio.cesare@xxxxxxxxx> > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxx> Patch applied to ath-next branch of ath.git, thanks. 4b6e9f3fe1d8 ath9k: eeprom: Use scnprintf instead of snprintf -- https://patchwork.kernel.org/patch/10765259/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
