diff options
author | Ahmad Fatoum <a.fatoum@pengutronix.de> | 2019-08-23 11:25:31 +0200 |
---|---|---|
committer | Sascha Hauer <s.hauer@pengutronix.de> | 2019-09-02 09:12:30 +0200 |
commit | 75a74b5c107b3bc30f9c3836208f4c17f9309eed (patch) | |
tree | 7e26a790234943bf84c46a1bd37ce4c84f84ed3c /common/console.c | |
parent | d421771bcea063b9bce551e06552067b9074d015 (diff) | |
download | barebox-75a74b5c107b3bc30f9c3836208f4c17f9309eed.tar.gz |
console: fix out-of-bounds read in dputc(/dev/*, ...)
Trying to output a single character via
echo -a /dev/serial0-1
currently results in garbage output after the newline, because console.c's
fops_write discards the buffer length and passes the buffer to
(struct cdev)::puts which only handles NUL-terminated strings.
Fix this by amending (struct cdev)::puts with a new nbytes parameter,
which is correctly propagated. All this functions now return at most the
nbytes parameter they were passed in. This fixes __console_puts, which
used to count new lines twice in its return value.
Fixes: b4f55fcf35 ("console: expose consoles in devfs")
Cc: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'common/console.c')
-rw-r--r-- | common/console.c | 19 |
1 files changed, 9 insertions, 10 deletions
diff --git a/common/console.c b/common/console.c index ee17a508ba..3f3a30fc82 100644 --- a/common/console.c +++ b/common/console.c @@ -253,20 +253,19 @@ static void console_set_stdoutpath(struct console_device *cdev) free(str); } -static int __console_puts(struct console_device *cdev, const char *s) +static int __console_puts(struct console_device *cdev, const char *s, + size_t nbytes) { - int n = 0; + size_t i; - while (*s) { - if (*s == '\n') { + for (i = 0; i < nbytes; i++) { + if (*s == '\n') cdev->putc(cdev, '\r'); - n++; - } + cdev->putc(cdev, *s); - n++; s++; } - return n; + return i; } static int fops_open(struct cdev *cdev, unsigned long flags) @@ -298,7 +297,7 @@ static ssize_t fops_write(struct cdev* dev, const void* buf, size_t count, { struct console_device *priv = dev->priv; - priv->puts(priv, buf); + priv->puts(priv, buf, count); return count; } @@ -545,7 +544,7 @@ int console_puts(unsigned int ch, const char *str) if (initialized == CONSOLE_INIT_FULL) { for_each_console(cdev) { if (cdev->f_active & ch) { - n = cdev->puts(cdev, str); + n = cdev->puts(cdev, str, strlen(str)); } } return n; |