diff options
| author | Alan <gnomes@lxorguk.ukuu.org.uk> | 2013-12-17 15:05:39 +0000 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2014-01-10 15:28:10 +0100 |
| commit | 6b6419005ef1590f4f532899222424b4539b0511 (patch) | |
| tree | 29715365969c7106f719cbe6931e024e58bc5691 /drivers/gpu/drm | |
| parent | bfb18d824c6a6cc401b73b1da9105aed81eb6434 (diff) | |
| download | linux-6b6419005ef1590f4f532899222424b4539b0511.tar.bz2 | |
mkregtable: Fix sscanf handling
If you feed the tool a suitable bogus register map you can break it
in arbitary (code executing) ways. While this isn't a particularly
exciting or probable attack vector we still ought to fix it.
One of a set of sscanf issues reported by Jackie Chang
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/gpu/drm')
| -rw-r--r-- | drivers/gpu/drm/radeon/mkregtable.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c index af85299f2126..4a85bb644e24 100644 --- a/drivers/gpu/drm/radeon/mkregtable.c +++ b/drivers/gpu/drm/radeon/mkregtable.c @@ -655,7 +655,7 @@ static int parser_auth(struct table *t, const char *filename) /* first line will contain the last register * and gpu name */ - sscanf(buf, "%s %s", gpu_name, last_reg_s); + sscanf(buf, "%9s %9s", gpu_name, last_reg_s); t->gpu_prefix = gpu_name; last_reg = strtol(last_reg_s, NULL, 16); |