From 8874b908254c47c8a6fd7a1aca2c7371c11035c4 Mon Sep 17 00:00:00 2001 From: Philipp Rudo Date: Tue, 11 Feb 2020 13:34:14 +0100 Subject: [PATCH] zipl/libc: Fix potential buffer overflow in printf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per definition vsprint assumes that the provided buffer it writes to is large enough to contain the formatted string. As printf uses a fixed sized buffer (81 bytes) and has no size checks the use of vsprintf can easily cause buffer overflows. Protect against these buffer overflows by using vsnprintf instead. While at it fix a typo in the comment. Reported-by: Marc Hartmayer Signed-off-by: Philipp Rudo Reviewed-by: Marc Hartmayer Reviewed-by: Stefan Haberland Signed-off-by: Jan Höppner --- zipl/boot/libc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zipl/boot/libc.c b/zipl/boot/libc.c index e5ca3222..0cbb2356 100644 --- a/zipl/boot/libc.c +++ b/zipl/boot/libc.c @@ -532,7 +532,7 @@ void sprintf(char *str, const char *fmt, ...) } /* - * Print formated string + * Print formatted string to console */ void printf(const char *fmt, ...) { @@ -540,7 +540,7 @@ void printf(const char *fmt, ...) va_list va; va_start(va, fmt); - vsprintf(buf, fmt, va); + vsnprintf(buf, sizeof(buf), fmt, va); sclp_print(buf); va_end(va); }