github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

um: vector: reject too many interface arguments

Browse Source 
uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.

Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260424070106.1-uml-vector-v2-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Pengpeng Hou 2026-04-23 23:35:00 +08:00 committed by Johannes Berg
parent 28ada50b74
commit 9756ecdbff
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
arch/um/drivers/vector_user.c
View File

@ -93,6 +93,9 @@ struct arglist *uml_parse_vector_ifspec(char *arg)
len = strlen(arg);
for (pos = 0; pos < len; pos++) {
if (next_starts) {
if (result->numargs >= MAXVARGS)
goto cleanup;
if (parsing_token) {
result->tokens[result->numargs] = arg + pos;
} else {