2023-09-05 18:53:57

by Konstantin Meskhidze

Subject: [PATCH] kconfig: fix possible buffer overflow

Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.

Fixes: e298f3b49def ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <[email protected]>
Signed-off-by: Konstantin Meskhidze <[email protected]>
---
scripts/kconfig/preprocess.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 748da578b418..d1f5bcff4b62 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -387,24 +387,27 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
if (new_argc >= FUNCTION_MAX_ARGS)
pperror("too many function arguments");
new_argv[new_argc++] = prev;
prev = p + 1;
} else if (*p == '(') {
nest++;
} else if (*p == ')') {
nest--;
}

p++;
}
+
+ if (new_argc >= FUNCTION_MAX_ARGS)
+ pperror("too many function arguments");
new_argv[new_argc++] = prev;

/*
* Shift arguments
* new_argv[0] represents a function name or a variable name. Put it
* into 'name', then shift the rest of the arguments. This simplifies
* 'const' handling.
*/
name = expand_string_with_args(new_argv[0], argc, argv);
new_argc--;
for (i = 0; i < new_argc; i++)
new_argv[i] = expand_string_with_args(new_argv[i + 1],
--
2.34.1

2023-09-05 19:54:20

by Masahiro Yamada

Subject: Re: [PATCH] kconfig: fix possible buffer overflow

On Tue, Sep 5, 2023 at 6:59 PM Konstantin Meskhidze
<[email protected]> wrote:
>
> Buffer 'new_argv' is accessed without bound check after accessing with
> bound check via 'new_argc' index.
>
> Fixes: e298f3b49def ("kconfig: add built-in function support")
> Co-developed-by: Ivanov Mikhail <[email protected]>
> Signed-off-by: Konstantin Meskhidze <[email protected]>
> ---


Applied to linux-kbuild.
Thanks.

--
Best Regards
Masahiro Yamada