Ilya Matveychikov 303177699c lib/cmdline.c: fix get_options() overflow while parsing ranges ...

commit a91e0f680bcd9e10c253ae8b62462a38bd48f09f upstream.

When using get_options() it's possible to specify a range of numbers,
like 1-100500.  The problem is that it doesn't track array size while
calling internally to get_range() which iterates over the range and
fills the memory with numbers.

Link: http://lkml.kernel.org/r/2613C75C-B04D-4BFF-82A6-12F97BA0F620@gmail.com
Signed-off-by: Ilya V. Matveychikov <matvejchikov@gmail.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>

2017-11-02 07:16:19 +01:00

..

lzo

lzo: check for length overrun in variable length encoding.

2014-10-30 09:35:11 -07:00

mpi

mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

2017-02-10 11:04:07 +01:00

raid6

…

reed_solomon

…

xz

…

zlib_deflate

…

zlib_inflate

…

.gitignore

…

argv_split.c

argv_split(): teach it to handle mutable strings

2013-04-29 18:28:19 -07:00

asn1_decoder.c

…

atomic64_test.c

…

atomic64.c

…

audit.c

…

average.c

…

bcd.c

…

bch.c

…

bitmap.c

__bitmap_parselist: fix bug in empty string handling

2015-08-03 09:29:46 -07:00

bitrev.c

…

bsearch.c

…

btree.c

lib/btree.c: fix leak of whole btree nodes

2014-08-07 14:30:27 -07:00

bug.c

…

build_OID_registry

…

bust_spinlocks.c

…

check_signature.c

…

checksum.c

lib/checksum.c: fix build for generic csum_tcpudp_nofold

2015-02-11 14:48:17 +08:00

clz_tab.c

…

cmdline.c

lib/cmdline.c: fix get_options() overflow while parsing ranges

2017-11-02 07:16:19 +01:00

cordic.c

…

cpu_rmap.c

…

cpu-notifier-error-inject.c

…

cpumask.c

…

crc7.c

…

crc8.c

…

crc16.c

…

crc32.c

…

crc32defs.h

…

crc-ccitt.c

…

crc-itu-t.c

…

crc-t10dif.c

…

ctype.c

…

debug_locks.c

…

debugobjects.c

…

dec_and_lock.c

…

decompress_bunzip2.c

decompress_bunzip2: off by one in get_next_block()

2015-01-27 07:52:33 -08:00

decompress_inflate.c

lib/decompressors: fix "no limit" output buffer length

2014-02-06 11:08:12 -08:00

decompress_unlzma.c

…

decompress_unlzo.c

…

decompress_unxz.c

…

decompress.c

lib/decompress.c: fix initconst

2013-04-30 17:04:09 -07:00

devres.c

devres: fix a for loop bounds check

2016-03-03 15:06:20 -08:00

digsig.c

lib/digsig: fix dereference of NULL user_key_payload

2017-11-02 07:16:18 +01:00

div64.c

Revert "math64: New div64_u64_rem helper"

2013-04-30 19:13:05 +02:00

dma-debug.c

dma-debug: avoid spinlock recursion when disabling dma-debug

2016-08-21 23:22:50 +02:00

dump_stack.c

dump_stack: consolidate dump_stack() implementations and unify their behaviors

2013-04-30 17:04:02 -07:00

dynamic_debug.c

dynamic_debug: reuse generic string_unescape function

2013-04-30 17:04:03 -07:00

dynamic_queue_limits.c

…

earlycpio.c

…

extable.c

…

fault-inject.c

lib/: rename random32() to prandom_u32()

2013-04-29 18:28:42 -07:00

fdt_ro.c

…

fdt_rw.c

…

fdt_strerror.c

…

fdt_sw.c

…

fdt_wip.c

…

fdt.c

…

find_last_bit.c

…

find_next_bit.c

…

flex_array.c

…

flex_proportions.c

…

gcd.c

…

gen_crc32table.c

…

genalloc.c

lib/genalloc.c: start search from start of chunk

2017-02-10 11:03:59 +01:00

halfmd4.c

…

hexdump.c

…

hweight.c

…

idr.c

idr: fix overflow bug during maximum ID calculation at maximum height

2014-06-30 20:09:42 -07:00

inflate.c

…

int_sqrt.c

…

interval_tree_test_main.c

…

interval_tree.c

…

iomap_copy.c

…

iomap.c

…

iommu-helper.c

…

ioremap.c

…

iovec.c

Hoist memcpy_fromiovec/memcpy_toiovec into lib/

2013-05-20 10:24:22 +09:30

irq_regs.c

…

is_single_threaded.c

…

jedec_ddr_data.c

…

kasprintf.c

…

Kconfig

…

Kconfig.debug

lib/Kconfig.debug: Restrict FRAME_POINTER for MIPS

2013-07-28 16:30:12 -07:00

Kconfig.kgdb

…

Kconfig.kmemcheck

…

kfifo.c

…

klist.c

klist: fix starting point removed bug in klist iterators

2016-02-25 11:57:47 -08:00

kobject_uevent.c

…

kobject.c

kref: minor cleanup

2013-05-07 16:09:00 -07:00

kstrtox.c

…

kstrtox.h

…

lcm.c

…

libcrc32c.c

…

list_debug.c

…

list_sort.c

lib/: rename random32() to prandom_u32()

2013-04-29 18:28:42 -07:00

llist.c

…

locking-selftest-hardirq.h

…

locking-selftest-mutex.h

…

locking-selftest-rlock-hardirq.h

…

locking-selftest-rlock-softirq.h

…

locking-selftest-rlock.h

…

locking-selftest-rsem.h

…

locking-selftest-softirq.h

…

locking-selftest-spin-hardirq.h

…

locking-selftest-spin-softirq.h

…

locking-selftest-spin.h

…

locking-selftest-wlock-hardirq.h

…

locking-selftest-wlock-softirq.h

…

locking-selftest-wlock.h

…

locking-selftest-wsem.h

…

locking-selftest.c

…

lru_cache.c

…

Makefile

x86, hweight: Fix BUG when booting with CONFIG_GCOV_PROFILE_ALL=y

2014-02-20 11:06:11 -08:00

md5.c

…

memory-notifier-error-inject.c

…

memweight.c

…

nlattr.c

netlink: rate-limit leftover bytes warning and print process name

2014-06-26 15:12:37 -04:00

notifier-error-inject.c

…

notifier-error-inject.h

…

of-reconfig-notifier-error-inject.c

…

oid_registry.c

Give the OID registry file module info to avoid kernel tainting

2013-05-05 14:38:00 -07:00

parser.c

…

pci_iomap.c

…

percpu_counter.c

…

percpu-rwsem.c

…

plist.c

…

pm-notifier-error-inject.c

…

prio_heap.c

…

proportions.c

…

radix-tree.c

radix-tree: fix race in gang lookup

2016-02-25 11:57:49 -08:00

random32.c

random32: fix off-by-one in seeding requirement

2013-12-08 07:29:24 -08:00

ratelimit.c

ratelimit: fix bug in time interval by resetting right begin time

2017-02-10 11:04:00 +01:00

rational.c

…

rbtree_test.c

rbtree_test: add __init/__exit annotations

2013-04-30 17:04:07 -07:00

rbtree.c

…

reciprocal_div.c

…

rwsem-spinlock.c

rwsem: simplify __rwsem_do_wake

2013-05-07 07:20:16 -07:00

rwsem.c

rwsem: check counter to avoid cmpxchg calls

2013-05-07 16:11:51 -07:00

scatterlist.c

lib/scatterlist.c: don't flush_kernel_dcache_page on slab page

2013-11-13 12:05:33 +09:00

sha1.c

…

show_mem.c

…

smp_processor_id.c

…

sort.c

…

spinlock_debug.c

…

stmp_device.c

…

string_helpers.c

lib/string_helpers: introduce generic string_unescape

2013-04-30 17:04:03 -07:00

string.c

lib: memzero_explicit: use barrier instead of OPTIMIZER_HIDE_VAR

2015-05-06 21:56:28 +02:00

strncpy_from_user.c

…

strnlen_user.c

lib: Fix strnlen_user() to not touch memory after specified maximum

2015-06-05 23:19:54 -07:00

swiotlb.c

…

syscall.c

…

test-kstrtox.c

…

test-string_helpers.c

lib/string_helpers: introduce generic string_unescape

2013-04-30 17:04:03 -07:00

textsearch.c

…

timerqueue.c

…

ts_bm.c

…

ts_fsm.c

…

ts_kmp.c

…

ucs2_string.c

lib/ucs2_string: Correct ucs2 -> utf8 conversion

2016-03-16 08:41:37 -07:00

usercopy.c

Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

2013-04-30 17:04:09 -07:00

uuid.c

uuid: use prandom_bytes()

2013-04-29 18:28:42 -07:00

vsprintf.c

vsprintf: check real user/group id for %pK

2013-12-04 10:56:06 -08:00