github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

Browse Source 
help_init() builds letter_offsets[] by using the first byte of each
function name as an index via `(start & 31) - 1`. If function_names are
overridden from sysfs (root) with a name starting outside [a–z], the
index underflows or exceeds the array, leading to OOB write.

Function names can be overridden with the following commands as root:

    modprobe speakup_soft
    echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names
    # then press Insert+2 on /dev/tty

This fix checks the first letter in help_init(), and if it is not in the
[a–z] range the function returns an error to the caller. Eventually this
error is propagated to drivers/accessibility/speakup/main.c:2217, which
causes a bleep sound.

Fixes: c6e3fd22cd ("Staging: add speakup to the staging directory")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Link: https://patch.msgid.link/20260531230804.254962-10-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pavel Zhigulin 2026-06-01 01:07:58 +02:00 committed by Greg Kroah-Hartman
parent 768ce60dc8
commit 6a19ad4d68
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/accessibility/speakup/keyhelp.c
View File

@ -8,6 +8,7 @@
*/
#include <linux/keyboard.h>
#include <linux/ctype.h>
#include "spk_priv.h"
#include "speakup.h"
@ -111,7 +112,7 @@ static void say_key(int key)
spk_msg_get(MSG_KEYNAMES_START + (key - 1)));
}
static int help_init(void)
static void help_init(void)
{
char start = SPACE;
int i;
@ -120,13 +121,19 @@ static int help_init(void)
state_tbl = spk_our_keys[0] + SHIFT_TBL_SIZE + 2;
for (i = 0; i < num_funcs; i++) {
char *cur_funcname = spk_msg_get(MSG_FUNCNAMES_START + i);
char first_letter;
if (start == *cur_funcname)
first_letter = tolower(*cur_funcname);
/* Accept only 'a'..'z' to index letter_offsets[] safely */
if (first_letter < 'a' || first_letter > 'z')
continue;
start = *cur_funcname;
if (start == first_letter)
continue;
start = first_letter;
letter_offsets[(start & 31) - 1] = i;
}
return 0;
}
int spk_handle_help(struct vc_data *vc, u_char type, u_char ch, u16 key)
@ -144,7 +151,7 @@ int spk_handle_help(struct vc_data *vc, u_char type, u_char ch, u16 key)
synth_printf("%s\n", spk_msg_get(MSG_LEAVING_HELP));
return 1;
}
ch |= 32; /* lower case */
ch = tolower(ch);
if (ch < 'a' || ch > 'z')
return -1;
if (letter_offsets[ch - 'a'] == -1) {