mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-04 08:08:54 +00:00
Code Issues Releases Wiki Activity

vt: avoid a VLA in the unicode screen scroll function

Browse source 
The nr argument is typically small: most often nr == 1. However this
could be abused with a very large explicit scroll in a resized screen.
Make the code scroll lines by performing an array rotation operation to
avoid the need for a large temporary space.

Requested-by: Kees Cook <keescook@chromium.org>
Suggested-by: Adam Borowski <kilobyte@angband.pl>
Signed-off-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Nicolas Pitre 2018-07-19 00:05:25 -04:00 committed by Greg Kroah-Hartman
parent 13aa0a1218
commit d541ae4e76
1 changed files with 22 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
drivers/tty/vt/vt.c
View file

@ -104,6 +104,7 @@
#include <linux/kdb.h> #include <linux/kdb.h>
#include <linux/ctype.h> #include <linux/ctype.h>
#include <linux/bsearch.h> #include <linux/bsearch.h>
#include <linux/gcd.h>
#define MAX_NR_CON_DRIVER 16 #define MAX_NR_CON_DRIVER 16
@ -434,20 +435,29 @@ static void vc_uniscr_scroll(struct vc_data *vc, unsigned int t, unsigned int b,
struct uni_screen *uniscr = get_vc_uniscr(vc); struct uni_screen *uniscr = get_vc_uniscr(vc);
if (uniscr) { if (uniscr) {
unsigned int s, d, rescue, clear; unsigned int i, j, k, sz, d, clear;
char32_t *save[nr];
s = clear = t; sz = b - t;
d = t + nr; clear = b - nr;
rescue = b - nr; d = nr;
if (dir == SM_UP) { if (dir == SM_DOWN) {
swap(s, d); clear = t;
swap(clear, rescue); d = sz - nr;
}
for (i = 0; i < gcd(d, sz); i++) {
char32_t *tmp = uniscr->lines[t + i];
j = i;
while (1) {
k = j + d;
if (k >= sz)
k -= sz;
if (k == i)
break;
uniscr->lines[t + j] = uniscr->lines[t + k];
j = k;
}
uniscr->lines[t + j] = tmp;
} }
memcpy(save, uniscr->lines + rescue, nr * sizeof(*save));
memmove(uniscr->lines + d, uniscr->lines + s,
(b - t - nr) * sizeof(*uniscr->lines));
memcpy(uniscr->lines + clear, save, nr * sizeof(*save));
vc_uniscr_clear_lines(vc, clear, nr); vc_uniscr_clear_lines(vc, clear, nr);
} }
} }