Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965745AbcJZN3o (ORCPT ); Wed, 26 Oct 2016 09:29:44 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:55049 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934452AbcJZMZY (ORCPT ); Wed, 26 Oct 2016 08:25:24 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Mark Brown Subject: [PATCH 4.8 007/140] spi: spidev_test: Fix buffer overflow in unescape() Date: Wed, 26 Oct 2016 14:21:07 +0200 Message-Id: <20161026122220.692717902@linuxfoundation.org> X-Mailer: git-send-email 2.10.1 In-Reply-To: <20161026122220.384323763@linuxfoundation.org> References: <20161026122220.384323763@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1339 Lines: 47 4.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Geert Uytterhoeven commit 0278b34bf15f8d8a609595b15909cd8622dd64ca upstream. Sometimes spidev_test crashes with: *** Error in `spidev_test': munmap_chunk(): invalid pointer: 0x00022020 *** Aborted or just Segmentation fault This is due to transfer_escaped_string() miscalculating the required size of the buffer by one byte, causing a buffer overflow in unescape(). Drop the bogus "+ 1" in the strlen() parameter to fix this. Note that unescape() never copies the zero-terminator of the source string, so it writes at most as many bytes as the length of the source string. Fixes: 30061915be6e3a2c (spi: spidev_test: Added input buffer from the terminal) Signed-off-by: Geert Uytterhoeven Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman --- tools/spi/spidev_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/spi/spidev_test.c +++ b/tools/spi/spidev_test.c @@ -284,7 +284,7 @@ static void parse_opts(int argc, char *a static void transfer_escaped_string(int fd, char *str) { - size_t size = strlen(str + 1); + size_t size = strlen(str); uint8_t *tx; uint8_t *rx;