Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
To:     <masahiroy@kernel.org>
CC:     <linux-kbuild@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <yusongping@huawei.com>, <artem.kuzin@huawei.com>
Subject: [PATCH] kconfig: fix possible buffer overflow
Date:   Tue, 5 Sep 2023 17:59:14 +0800
Message-ID: <20230905095914.1699335-1-konstantin.meskhidze@huawei.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7BIT
Content-Type:   text/plain; charset=US-ASCII
Precedence: bulk

Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.

Fixes: e298f3b49def ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
---
 scripts/kconfig/preprocess.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 748da578b418..d1f5bcff4b62 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -387,24 +387,27 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
 			if (new_argc >= FUNCTION_MAX_ARGS)
 				pperror("too many function arguments");
 			new_argv[new_argc++] = prev;
 			prev = p + 1;
 		} else if (*p == '(') {
 			nest++;
 		} else if (*p == ')') {
 			nest--;
 		}
 
 		p++;
 	}
+
+	if (new_argc >= FUNCTION_MAX_ARGS)
+		pperror("too many function arguments");
 	new_argv[new_argc++] = prev;
 
 	/*
 	 * Shift arguments
 	 * new_argv[0] represents a function name or a variable name.  Put it
 	 * into 'name', then shift the rest of the arguments.  This simplifies
 	 * 'const' handling.
 	 */
 	name = expand_string_with_args(new_argv[0], argc, argv);
 	new_argc--;
 	for (i = 0; i < new_argc; i++)
 		new_argv[i] = expand_string_with_args(new_argv[i + 1],
-- 
2.34.1