Re: [PATCH] tg3: fix length overflow in VPD firmware parsing
From: David Miller <davem@davemloft.net>
Date: 2013-03-27 18:11:38
Also in:
lkml
From: Kees Cook <redacted> Date: Wed, 27 Mar 2013 09:40:50 -0700
Commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 ("tg3: Use VPD fw version
when present") introduced VPD parsing that contained a potential length
overflow.
Limit the hardware's reported firmware string length (max 255 bytes) to
stay inside the driver's firmware string length (32 bytes). On overflow,
truncate the formatted firmware string instead of potentially overwriting
portions of the tg3 struct.
http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf
Signed-off-by: Kees Cook <redacted>
Reported-by: Oded Horovitz <redacted>
Reported-by: Brad Spengler <redacted>Applied.