Commit c7cc4dc2 authored Sep 05, 2023 by Konstantin Meskhidze Committed by Greg Kroah-Hartman Sep 23, 2023

kconfig: fix possible buffer overflow



[ Upstream commit a3b7039bb2b22fcd2ad20d59c00ed4e606ce3754 ]

Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.

Fixes: e298f3b4 ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 0158dab8

scripts/kconfig/preprocess.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -396,6 +396,9 @@ static char eval_clause(const char str, size_t len, int argc, char *argv[])

		p++;
		}

		if (new_argc >= FUNCTION_MAX_ARGS)
		pperror("too many function arguments");
		new_argv[new_argc++] = prev;

		/*