Skip to content

fix: the combination of buffer overflows (v-001, v-0... in... #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hangzqcom merged 3 commits into from
Jun 19, 2026
+4 −5
Merged

fix: the combination of buffer overflows (v-001, v-0... in... #42

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b647de5
fix: V-008 security vulnerability
orbisai0security May 14, 2026
49b7269
fix: replace snprintf with scnprintf in sysfs/proc show handlers
orbisai0security May 16, 2026
a17d79e
fix: remove redundant null terminator after snprintf
orbisai0security Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions src/linux/qcom_usbnet/qcom_usbnet_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,8 +160,7 @@ sGobiUSBNet *GobiAcquireDevice(char *mpKey, struct usbnet * pDev)
}
else
{
sprintf(commonDevName,"%s:%d-%s", mpKey, pDev->udev->bus->busnum, pDev->udev->devpath);
commonDevName[254] = '\0';
snprintf(commonDevName, sizeof(commonDevName), "%s:%d-%s", mpKey, pDev->udev->bus->busnum, pDev->udev->devpath);

list_for_each_entry(pGobiDev, &DeviceListIdle, node)
{
Expand Down Expand Up @@ -2481,7 +2480,7 @@ static ssize_t debug_show(struct kobject *kobj,
qmi_sys = (qmi_sys<<8) + logLvl;
}
}
return sprintf(buf, "%04x\n", qmi_sys);
return scnprintf(buf, PAGE_SIZE, "%04x\n", qmi_sys);
}

static ssize_t debug_store(struct kobject *kobj,
Expand Down Expand Up @@ -2576,7 +2575,7 @@ static ssize_t gobiQMITimer_show(struct kobject *kobj,
#ifdef TX_AGGR
ctx = &pDevOnRecord->tx_aggr_ctx;
if (ctx->timer_interval)
return sprintf(buf, "%llu\n", ctx->timer_interval / (u32)NSEC_PER_MSEC);
return scnprintf(buf, PAGE_SIZE, "%llu\n", ctx->timer_interval / (u32)NSEC_PER_MSEC);
#endif

@shasaror Shashank Arora (shasaror) May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same as mentioned above.
timer_internal defined as long long (8 bytes)

@hangzqcom hangzqcom May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In principle should use scnprintf(buf, PAGE_SIZE,...)

@orbisai0security OrbisAI Security (orbisai0security) May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same answer as above — PAGE_SIZE is the kernel-guaranteed size of the buf pointer passed to any sysfs show callback. For timer_interval (a u64 in ns, displayed in ms), the formatted output is a handful of characters, well within the page. Using PAGE_SIZE as the bound is the standard pattern. Updated to scnprintf per hangzqcom's feedback (commit 49b7269).

@orbisai0security OrbisAI Security (orbisai0security) May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done — updated to scnprintf(buf, PAGE_SIZE, ...) in commit 49b7269.

}
}
Expand Down Expand Up @@ -3129,7 +3128,7 @@ static ssize_t GobiUSBprocRead(struct file *file, char __user *ubuf,size_t count
if(*ppos > 0 || count < BUFSIZE)
return 0;

len += sprintf(buf, "%d %ld ms\n", debug_g, gtimer/NSEC_PER_USEC);
len += scnprintf(buf, BUFSIZE, "%d %ld ms\n", debug_g, gtimer/NSEC_PER_USEC);

if(copy_to_user(ubuf,buf,len))
return -EFAULT;
Expand Down
Loading