Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 708d96fd authored by Ryan Mallon's avatar Ryan Mallon Committed by Linus Torvalds
Browse files

vsprintf: remove %n handling 



All in-kernel users of %n in format strings have now been removed and
the %n directive is ignored.  Remove the handling of %n so that it is
treated the same as any other invalid format string directive.  Keep a
warning in place to deter new instances of %n in format strings.

Signed-off-by: default avatarRyan Mallon <rmallon@gmail.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 28ab49ff

lib/vsprintf.c

+9 −36
Original line number Diff line number Diff line
@@ -364,7 +364,6 @@ enum format_type { 
	FORMAT_TYPE_SHORT,

	FORMAT_TYPE_UINT,

	FORMAT_TYPE_INT,

	FORMAT_TYPE_NRCHARS,

	FORMAT_TYPE_SIZE_T,

	FORMAT_TYPE_PTRDIFF

};
@@ -1538,10 +1537,6 @@ int format_decode(const char *fmt, struct printf_spec *spec) 
		return fmt - start;

		/* skip alnum */



	case 'n':

		spec->type = FORMAT_TYPE_NRCHARS;

		return ++fmt - start;



	case '%':

		spec->type = FORMAT_TYPE_PERCENT_CHAR;

		return ++fmt - start;
@@ -1564,6 +1559,15 @@ int format_decode(const char *fmt, struct printf_spec *spec) 
	case 'u':

		break;



	case 'n':

		/*

		 * Since %n poses a greater security risk than utility, treat

		 * it as an invalid format specifier. Warn about its use so

		 * that new instances don't get added.

		 */

		WARN_ONCE(1, "Please remove ignored %%n in '%s'\n", fmt);

		/* Fall-through */



	default:

		spec->type = FORMAT_TYPE_INVALID;

		return fmt - start;
@@ -1737,20 +1741,6 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) 
			++str;

			break;



		case FORMAT_TYPE_NRCHARS: {

			/*

			 * Since %n poses a greater security risk than

			 * utility, ignore %n and skip its argument.

			 */

			void *skip_arg;



			WARN_ONCE(1, "Please remove ignored %%n in '%s'\n",

					old_fmt);



			skip_arg = va_arg(args, void *);

			break;

		}



		default:

			switch (spec.type) {

			case FORMAT_TYPE_LONG_LONG:
@@ -2025,19 +2015,6 @@ do { \ 
				fmt++;

			break;



		case FORMAT_TYPE_NRCHARS: {

			/* skip %n 's argument */

			u8 qualifier = spec.qualifier;

			void *skip_arg;

			if (qualifier == 'l')

				skip_arg = va_arg(args, long *);

			else if (_tolower(qualifier) == 'z')

				skip_arg = va_arg(args, size_t *);

			else

				skip_arg = va_arg(args, int *);

			break;

		}



		default:

			switch (spec.type) {
@@ -2196,10 +2173,6 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) 
			++str;

			break;



		case FORMAT_TYPE_NRCHARS:

			/* skip */

			break;



		default: {

			unsigned long long num;