github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-09 13:44:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

um: account for the separator in add_arg() bounds checking

Browse Source 
add_arg() checks whether command_line and arg fit in the fixed
COMMAND_LINE_SIZE buffer, but when command_line is non-empty it inserts
an additional space before appending arg. The current guard does not
account for that separator, so a non-empty command line can pass the
check and still overflow by one byte.

Count the separator when command_line already contains data.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260330062921.40824-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Pengpeng Hou 2026-03-30 14:29:21 +08:00 committed by Johannes Berg
parent 93f51579e7
commit 2f89719949
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
arch/um/kernel/um_arch.c
View File

@ -44,7 +44,12 @@ static char __initdata command_line[COMMAND_LINE_SIZE] = { 0 };
static void __init add_arg(char *arg)
{
if (strlen(command_line) + strlen(arg) + 1 > COMMAND_LINE_SIZE) {
size_t len = strlen(command_line) + strlen(arg) + 1;
if (command_line[0])
len++;
if (len > COMMAND_LINE_SIZE) {
os_warn("add_arg: Too many command line arguments!\n");
exit(1);
}