From 9756ecdbffe61797fe1c81bc62ca48eaa27d4055 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Thu, 23 Apr 2026 23:35:00 +0800 Subject: um: vector: reject too many interface arguments uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed struct arglist token and value arrays, which are both sized to MAXVARGS. The parser increments numargs as it discovers pairs, but it never checks whether another slot is still available before writing into the arrays. Reject interface specifications that exceed MAXVARGS instead of writing past the end of the fixed argument arrays. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260424070106.1-uml-vector-v2-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg --- arch/um/drivers/vector_user.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'arch') diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c index 2ea67e6fd067..3bee634f2102 100644 --- a/arch/um/drivers/vector_user.c +++ b/arch/um/drivers/vector_user.c @@ -93,6 +93,9 @@ struct arglist *uml_parse_vector_ifspec(char *arg) len = strlen(arg); for (pos = 0; pos < len; pos++) { if (next_starts) { + if (result->numargs >= MAXVARGS) + goto cleanup; + if (parsing_token) { result->tokens[result->numargs] = arg + pos; } else { -- cgit v1.2.3