diff options
author | Alan <gnomes@lxorguk.ukuu.org.uk> | 2013-12-17 10:05:39 -0500 |
---|---|---|
committer | Jiri Kosina <jkosina@suse.cz> | 2014-01-10 09:28:10 -0500 |
commit | 6b6419005ef1590f4f532899222424b4539b0511 (patch) | |
tree | 29715365969c7106f719cbe6931e024e58bc5691 /drivers/gpu | |
parent | bfb18d824c6a6cc401b73b1da9105aed81eb6434 (diff) |
mkregtable: Fix sscanf handling
If you feed the tool a suitable bogus register map you can break it
in arbitary (code executing) ways. While this isn't a particularly
exciting or probable attack vector we still ought to fix it.
One of a set of sscanf issues reported by Jackie Chang
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/gpu')
-rw-r--r-- | drivers/gpu/drm/radeon/mkregtable.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c index af85299f2126..4a85bb644e24 100644 --- a/drivers/gpu/drm/radeon/mkregtable.c +++ b/drivers/gpu/drm/radeon/mkregtable.c | |||
@@ -655,7 +655,7 @@ static int parser_auth(struct table *t, const char *filename) | |||
655 | 655 | ||
656 | /* first line will contain the last register | 656 | /* first line will contain the last register |
657 | * and gpu name */ | 657 | * and gpu name */ |
658 | sscanf(buf, "%s %s", gpu_name, last_reg_s); | 658 | sscanf(buf, "%9s %9s", gpu_name, last_reg_s); |
659 | t->gpu_prefix = gpu_name; | 659 | t->gpu_prefix = gpu_name; |
660 | last_reg = strtol(last_reg_s, NULL, 16); | 660 | last_reg = strtol(last_reg_s, NULL, 16); |
661 | 661 | ||