diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-04-23 23:35:00 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-24 16:21:29 +0200 |
| commit | 9756ecdbffe61797fe1c81bc62ca48eaa27d4055 (patch) | |
| tree | 571ea8624e5e16fc2d794aebb093b45e4ec81bdf /arch/um/drivers | |
| parent | 28ada50b743e956731280b817572335f33890a0f (diff) | |
um: vector: reject too many interface arguments
uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.
Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260424070106.1-uml-vector-v2-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'arch/um/drivers')
| -rw-r--r-- | arch/um/drivers/vector_user.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c index 2ea67e6fd067..3bee634f2102 100644 --- a/arch/um/drivers/vector_user.c +++ b/arch/um/drivers/vector_user.c @@ -93,6 +93,9 @@ struct arglist *uml_parse_vector_ifspec(char *arg) len = strlen(arg); for (pos = 0; pos < len; pos++) { if (next_starts) { + if (result->numargs >= MAXVARGS) + goto cleanup; + if (parsing_token) { result->tokens[result->numargs] = arg + pos; } else { |