summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorMikulas Patocka <mpatocka@redhat.com>2022-04-27 18:26:40 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2022-04-27 20:57:33 +0300
commite4d8a29997731b3bb14059024b24df9f784288d0 (patch)
treef00d3677b90779d9ff1a41bb401e8c9f40c69d1c /lib
parente5be15767e7e284351853cbaba80cde8620341fb (diff)
downloadlinux-e4d8a29997731b3bb14059024b24df9f784288d0.tar.xz
hex2bin: fix access beyond string end
If we pass too short string to "hex2bin" (and the string size without the terminating NUL character is even), "hex2bin" reads one byte after the terminating NUL character. This patch fixes it. Note that hex_to_bin returns -1 on error and hex2bin return -EINVAL on error - so we can't just return the variable "hi" or "lo" on error. This inconsistency may be fixed in the next merge window, but for the purpose of fixing this bug, we just preserve the existing behavior and return -1 and -EINVAL. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Fixes: b78049831ffe ("lib: add error checking to hex2bin") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/hexdump.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 369420ce553a..06833d404398 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -63,10 +63,13 @@ EXPORT_SYMBOL(hex_to_bin);
int hex2bin(u8 *dst, const char *src, size_t count)
{
while (count--) {
- int hi = hex_to_bin(*src++);
- int lo = hex_to_bin(*src++);
+ int hi, lo;
- if ((hi < 0) || (lo < 0))
+ hi = hex_to_bin(*src++);
+ if (unlikely(hi < 0))
+ return -EINVAL;
+ lo = hex_to_bin(*src++);
+ if (unlikely(lo < 0))
return -EINVAL;
*dst++ = (hi << 4) | lo;