| From 91dc7bf7cabdafffe131ba54cf10a1598ffbbcb5 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 5 Sep 2023 17:59:14 +0800 |
| Subject: kconfig: fix possible buffer overflow |
| |
| From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> |
| |
| [ Upstream commit a3b7039bb2b22fcd2ad20d59c00ed4e606ce3754 ] |
| |
| Buffer 'new_argv' is accessed without bound check after accessing with |
| bound check via 'new_argc' index. |
| |
| Fixes: e298f3b49def ("kconfig: add built-in function support") |
| Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com> |
| Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> |
| Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| scripts/kconfig/preprocess.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c |
| index 748da578b418c..d1f5bcff4b62d 100644 |
| --- a/scripts/kconfig/preprocess.c |
| +++ b/scripts/kconfig/preprocess.c |
| @@ -396,6 +396,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[]) |
| |
| p++; |
| } |
| + |
| + if (new_argc >= FUNCTION_MAX_ARGS) |
| + pperror("too many function arguments"); |
| new_argv[new_argc++] = prev; |
| |
| /* |
| -- |
| 2.40.1 |
| |
