summaryrefslogtreecommitdiffstats
path: root/common/console.c
diff options
context:
space:
mode:
authorAhmad Fatoum <a.fatoum@pengutronix.de>2019-08-23 11:25:31 +0200
committerSascha Hauer <s.hauer@pengutronix.de>2019-09-02 09:12:30 +0200
commit75a74b5c107b3bc30f9c3836208f4c17f9309eed (patch)
tree7e26a790234943bf84c46a1bd37ce4c84f84ed3c /common/console.c
parentd421771bcea063b9bce551e06552067b9074d015 (diff)
downloadbarebox-75a74b5c107b3bc30f9c3836208f4c17f9309eed.tar.gz
console: fix out-of-bounds read in dputc(/dev/*, ...)
Trying to output a single character via echo -a /dev/serial0-1 currently results in garbage output after the newline, because console.c's fops_write discards the buffer length and passes the buffer to (struct cdev)::puts which only handles NUL-terminated strings. Fix this by amending (struct cdev)::puts with a new nbytes parameter, which is correctly propagated. All this functions now return at most the nbytes parameter they were passed in. This fixes __console_puts, which used to count new lines twice in its return value. Fixes: b4f55fcf35 ("console: expose consoles in devfs") Cc: Bastian Krause <bst@pengutronix.de> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'common/console.c')
-rw-r--r--common/console.c19
1 files changed, 9 insertions, 10 deletions
diff --git a/common/console.c b/common/console.c
index ee17a50..3f3a30f 100644
--- a/common/console.c
+++ b/common/console.c
@@ -253,20 +253,19 @@ static void console_set_stdoutpath(struct console_device *cdev)
free(str);
}
-static int __console_puts(struct console_device *cdev, const char *s)
+static int __console_puts(struct console_device *cdev, const char *s,
+ size_t nbytes)
{
- int n = 0;
+ size_t i;
- while (*s) {
- if (*s == '\n') {
+ for (i = 0; i < nbytes; i++) {
+ if (*s == '\n')
cdev->putc(cdev, '\r');
- n++;
- }
+
cdev->putc(cdev, *s);
- n++;
s++;
}
- return n;
+ return i;
}
static int fops_open(struct cdev *cdev, unsigned long flags)
@@ -298,7 +297,7 @@ static ssize_t fops_write(struct cdev* dev, const void* buf, size_t count,
{
struct console_device *priv = dev->priv;
- priv->puts(priv, buf);
+ priv->puts(priv, buf, count);
return count;
}
@@ -545,7 +544,7 @@ int console_puts(unsigned int ch, const char *str)
if (initialized == CONSOLE_INIT_FULL) {
for_each_console(cdev) {
if (cdev->f_active & ch) {
- n = cdev->puts(cdev, str);
+ n = cdev->puts(cdev, str, strlen(str));
}
}
return n;