Felix Fietkau edc8daeffe kernel: crashlog: Avoid out-of-bounds write ...

vsnprintf returns the number of chars that would have been written, not
the actual number of chars written. This can lead to crashlog_buf->len
being too big which in turn can lead to get_maxlen() returning negative
numbers. The length argument of kmsg_dump_get_buffer will be casted to
a size_t which makes a negative input a big positive number allowing
kmsg_dump_get_buffer to write out of bounds.

Fix this by using vscnprintf which returns the actually written number
of chars.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37820 3c298f89-4303-0410-b956-a3cf2f4a3e73

2013-08-21 20:59:25 +00:00

..

imagebuilder

build: consistently use 'depends on' instead of 'depends'

2013-04-17 15:36:41 +00:00

linux

kernel: crashlog: Avoid out-of-bounds write

2013-08-21 20:59:25 +00:00

sdk

build: consistently use 'depends on' instead of 'depends'

2013-04-17 15:36:41 +00:00

toolchain

build: consistently use 'depends on' instead of 'depends'

2013-04-17 15:36:41 +00:00

Config.in

kernel: add a new global config symbol for enabling rfkill support (can be enabled by default via target feature flag)

2013-07-21 11:55:30 +00:00

Makefile

target: do not make target/*/install depend on target/*/compile - removes one redundant kernel build dir call on target/install

2012-06-06 17:24:05 +00:00