In-Reply-To: <[email protected]>
On Thu, 26 Jan 2006 at 20:50:38 +0100, Horst Schirmeier wrote:
> input: USB HID v1.10 Keyboard [Logitech USB Receiver] on usb-0000:00:04.2-1
> Badness in vsnprintf at lib/vsprintf.c:279
> [<c0324f64>] vsnprintf+0x544/0x550
> [<c0324fbc>] snprintf+0x1c/0x30
> [<c03ec17a>] print_modalias_bits+0x8a/0x90
> [<c03ec213>] print_modalias+0x93/0x1d0
> [<c03ec8c0>] input_dev_uevent+0x1d0/0x4b0
> [<c0384060>] class_uevent+0xb0/0x260
> [<c0383fb0>] class_uevent+0x0/0x260
> [<c03223f1>] kobject_uevent+0x3f1/0x450
print_modalias() passed a negative length to snprintf().
There's a general lack of error checking in the whole area;
input_dev_uevent() does:
envp[i++] = buffer + len;
len += snprintf(buffer + len, buffer_size - len, "MODALIAS=");
len += print_modalias(buffer + len, buffer_size - len, dev) + 1;
envp[i] = NULL;
and never checks whether 'buffer_size - len' is negative or even if there
is space in envp[] for another pointer. And print_modalias() and
print_modalias_bits() don't check anything either.
Maybe the modalias shouldn't be in there at all since there doesn't seem to
be enough space for it?
--
Chuck
"Equations are the Devil's sentences." --Stephen Colbert
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
