luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vsprintf: remove %n handling

Browse Source 
All in-kernel users of %n in format strings have now been removed and
the %n directive is ignored.  Remove the handling of %n so that it is
treated the same as any other invalid format string directive.  Keep a
warning in place to deter new instances of %n in format strings.

Signed-off-by: Ryan Mallon <rmallon@gmail.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Ryan Mallon 2014-04-03 14:48:37 -07:00 committed by Linus Torvalds
parent 28ab49ff7f
commit 708d96fd06
1 changed files with 9 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
lib/vsprintf.c
View File

@ -364,7 +364,6 @@ enum format_type {
FORMAT_TYPE_SHORT,
FORMAT_TYPE_UINT,
FORMAT_TYPE_INT,
FORMAT_TYPE_NRCHARS,
FORMAT_TYPE_SIZE_T,
FORMAT_TYPE_PTRDIFF
};
@ -1538,10 +1537,6 @@ int format_decode(const char *fmt, struct printf_spec *spec)
return fmt - start;
/* skip alnum */
case 'n':
spec->type = FORMAT_TYPE_NRCHARS;
return ++fmt - start;
case '%':
spec->type = FORMAT_TYPE_PERCENT_CHAR;
return ++fmt - start;
@ -1564,6 +1559,15 @@ int format_decode(const char *fmt, struct printf_spec *spec)
case 'u':
break;
case 'n':
/*
* Since %n poses a greater security risk than utility, treat
* it as an invalid format specifier. Warn about its use so
* that new instances don't get added.
*/
WARN_ONCE(1, "Please remove ignored %%n in '%s'\n", fmt);
/* Fall-through */
default:
spec->type = FORMAT_TYPE_INVALID;
return fmt - start;
@ -1737,20 +1741,6 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
++str;
break;
case FORMAT_TYPE_NRCHARS: {
/*
* Since %n poses a greater security risk than
* utility, ignore %n and skip its argument.
*/
void *skip_arg;
WARN_ONCE(1, "Please remove ignored %%n in '%s'\n",
old_fmt);
skip_arg = va_arg(args, void *);
break;
}
default:
switch (spec.type) {
case FORMAT_TYPE_LONG_LONG:
@ -2025,19 +2015,6 @@ do { \
fmt++;
break;
case FORMAT_TYPE_NRCHARS: {
/* skip %n 's argument */
u8 qualifier = spec.qualifier;
void *skip_arg;
if (qualifier == 'l')
skip_arg = va_arg(args, long *);
else if (_tolower(qualifier) == 'z')
skip_arg = va_arg(args, size_t *);
else
skip_arg = va_arg(args, int *);
break;
}
default:
switch (spec.type) {
@ -2196,10 +2173,6 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
++str;
break;
case FORMAT_TYPE_NRCHARS:
/* skip */
break;
default: {
unsigned long long num;