Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 115669 - possible buffer overflow in hwsetup
Summary: possible buffer overflow in hwsetup
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: x86 Linux
: High normal
Assignee: Gentoo LiveCD Package Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-12-15 09:07 UTC by pharon
Modified: 2005-12-20 14:27 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
patch to fix the segfault (hwsetup-1.1-dyn_blacklist_bounds_check.patch,742 bytes, patch)
2005-12-15 11:17 UTC, pharon
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description pharon 2005-12-15 09:07:52 UTC
I submitted a patch to implement dynamic blacklist generation in hwsetup using
/etc/hotplug/blacklist to prevent loading of misbehaving drivers from being loaded.

But if the file has more than 200 module names hwsetup will segfault. I attatch
a patch to add primitive bounds checking and reduce the memory footprint of the
function.

The coding is horrible maybe, can someone else who knows better can rewrite it
using malloc and realloc?

Reproducible: Always
Steps to Reproduce:
1.emerge hwsetup
2.fill up /etc/hotplug/blacklist with more than 200 module names
3.run hwsetup
3.segfault

Actual Results:  
Segfault

Expected Results:  
Doesn't segfault

The bug description on my blog http://www.phaeronix.net/node/74 with the patch
http://phaeronix.net/files/hwsetup-1.1-dyn_blacklist_bounds_check.patch.txt
Comment 1 pharon 2005-12-15 11:17:23 UTC
Created attachment 74814 [details, diff]
patch to fix the segfault

this is primitive bounds checking. Someone with better skills could make this
using array of pointers to strings and use malloc and realloc, but I am too
lazy.
Comment 2 Chris Gianelloni (RETIRED) gentoo-dev 2005-12-16 08:16:30 UTC
Thanks for the patch... currently my machines are down so I can't get this done
until after I get back power.  I had gotten your email, but haven't had much
time to do anything with the local ice storms.
Comment 3 pharon 2005-12-16 14:21:14 UTC
no problem beware of the frost bite :)
Comment 4 Chris Gianelloni (RETIRED) gentoo-dev 2005-12-20 14:27:23 UTC
Fixed in CVS...