Page MenuHomeFreeBSD

Fix ndiscvt crash on some .inf files
ClosedPublic

Authored by AMDmi3 on Sep 22 2015, 4:32 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Jan 22, 3:45 AM
Unknown Object (File)
Dec 3 2025, 8:08 AM
Unknown Object (File)
Nov 16 2025, 9:14 AM
Unknown Object (File)
Nov 13 2025, 5:58 PM
Unknown Object (File)
Nov 3 2025, 7:40 PM
Unknown Object (File)
Oct 28 2025, 2:07 AM
Unknown Object (File)
Oct 28 2025, 2:07 AM
Unknown Object (File)
Oct 28 2025, 2:07 AM
Subscribers

Details

Summary

ndiscvt uses fixed 16 entry array for `words' into which it parses comma-separated lists of strings, as in

[BLAH]
    AddReg = foo.reg, bar.reg, baz.reg, quiz.reg

Here it'll parse 4 words.

Overflow of this array is not checked, which leads to segfault on parsing specific .inf files (I've got a crash report on some broadcom driver which has a line with 17 words)

So,

  • Extend the array up to 32 entries
  • Add overflow check

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 583
Build 583: arc lint + arc unit

Event Timeline

AMDmi3 retitled this revision from to Fix ndiscvt crash on some .inf files.
AMDmi3 updated this object.
AMDmi3 edited the test plan for this revision. (Show Details)
AMDmi3 added a reviewer: bapt.
bapt edited edge metadata.
bapt added inline comments.
usr.sbin/ndiscvt/inf.c
890

Please add a space before that line (aka before the if)

This revision is now accepted and ready to land.Sep 22 2015, 4:39 PM
This revision was automatically updated to reflect the committed changes.