summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCarl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>2016-03-13 17:36:49 +0000
committerCarl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>2016-03-13 17:36:49 +0000
commitc1099d8f7ecdc18278a91ed545dc5e224a29ec54 (patch)
tree256397cb2fdd75f385eae063502253f1985956ae
parent8b6690ccbd9cf5f81aa2dc1a2095e75af172f819 (diff)
downloadflashrom-c1099d8f7ecdc18278a91ed545dc5e224a29ec54.tar.gz
flashrom-c1099d8f7ecdc18278a91ed545dc5e224a29ec54.tar.bz2
flashrom-c1099d8f7ecdc18278a91ed545dc5e224a29ec54.zip
Fix fscanf format string security bug in layout.c
An internal security audit of the flashrom project by Carl-Daniel Hailfinger found a buffer overflow bug present in all flashrom versions since the year 2005. This bug was independently found and reported to flashrom.org by Cosmin Gorgovan a few days ago. A buffer on the stack and a buffer on the heap are affected by the overflow caused by an incorrect fscanf format string. The buffer overflow can only be triggered if the optional layout feature is used and if the user manually specifies a specially crafted layout file on the command line. Command line parsing and flash image handling do not trigger the buggy code path. Most usage of flashrom does not involve layout files. The fix in this commit (changed fscanf format string) can be applied to layout.c of all past flashrom versions. Corresponding to flashrom svn r1953. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net> Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
-rw-r--r--layout.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/layout.c b/layout.c
index d03945138..f71eeaa80 100644
--- a/layout.c
+++ b/layout.c
@@ -68,7 +68,7 @@ int read_romlayout(const char *name)
(void)fclose(romlayout);
return 1;
}
- if (2 != fscanf(romlayout, "%s %s\n", tempstr, rom_entries[num_rom_entries].name))
+ if (2 != fscanf(romlayout, "%255s %255s\n", tempstr, rom_entries[num_rom_entries].name))
continue;
#if 0
// fscanf does not like arbitrary comments like that :( later