Skip to content
Snippets Groups Projects
  • Vasiliy Kulikov's avatar
    dda0b386
    net: ipv4: tcp_probe: cleanup snprintf() use · dda0b386
    Vasiliy Kulikov authored
    
    snprintf() returns number of bytes that were copied if there is no overflow.
    This code uses return value as number of copied bytes.  Theoretically format
    string '%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n' may be expanded
    up to 163 bytes.  In reality tv.tv_sec is just few bytes instead of 20, 2 ports
    are just 5 bytes each instead of 10, length is 5 bytes instead of 10.  The rest
    is an unstrusted input.  Theoretically if tv_sec is big then copy_to_user() would
    overflow tbuf.
    
    tbuf was increased to fit in 163 bytes.  snprintf() is used to follow return
    value semantic.
    
    Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    dda0b386
    History
    net: ipv4: tcp_probe: cleanup snprintf() use
    Vasiliy Kulikov authored
    
    snprintf() returns number of bytes that were copied if there is no overflow.
    This code uses return value as number of copied bytes.  Theoretically format
    string '%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n' may be expanded
    up to 163 bytes.  In reality tv.tv_sec is just few bytes instead of 20, 2 ports
    are just 5 bytes each instead of 10, length is 5 bytes instead of 10.  The rest
    is an unstrusted input.  Theoretically if tv_sec is big then copy_to_user() would
    overflow tbuf.
    
    tbuf was increased to fit in 163 bytes.  snprintf() is used to follow return
    value semantic.
    
    Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>