Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937521AbdCJNdR (ORCPT ); Fri, 10 Mar 2017 08:33:17 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:43668 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934354AbdCJLw3 (ORCPT ); Fri, 10 Mar 2017 06:52:29 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Willy Tarreau" , "Linus Torvalds" , "Jiri Kosina" , "Randy Dunlap" , "Rasmus Villemoes" Date: Fri, 10 Mar 2017 11:46:23 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 310/370] lib/vsprintf.c: improve sanity check in vsnprintf() In-Reply-To: X-SA-Exim-Connect-IP: 82.70.136.246 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1205 Lines: 35 3.16.42-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Rasmus Villemoes commit 2aa2f9e21e4eb25c720b2e7d80f8929638f6ad73 upstream. On 64 bit, size may very well be huge even if bit 31 happens to be 0. Somehow it doesn't feel right that one can pass a 5 GiB buffer but not a 3 GiB one. So cap at INT_MAX as was probably the intention all along. This is also the made-up value passed by sprintf and vsprintf. Signed-off-by: Rasmus Villemoes Cc: Jiri Kosina Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings Cc: Willy Tarreau --- lib/vsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1657,7 +1657,7 @@ int vsnprintf(char *buf, size_t size, co /* Reject out-of-range values early. Large positive sizes are used for unknown buffer sizes. */ - if (WARN_ON_ONCE((int) size < 0)) + if (WARN_ON_ONCE(size > INT_MAX)) return 0; str = buf;