diff options
| author | maxv <maxv@NetBSD.org> | 2020-07-11 07:14:53 +0000 |
|---|---|---|
| committer | maxv <maxv@NetBSD.org> | 2020-07-11 07:14:53 +0000 |
| commit | 559b72bdcc09b1ece2deca9f4d6bf62fb4cfd2a5 (patch) | |
| tree | 40cc6bf23751fded9447a8b1bbcd9eb409857094 | |
| parent | c1d1818ef80bab01a06fb2dfef0795fd2bb2ff5f (diff) | |
Remove support for '%n' in the kernel printf functions.
It makes vulnerabilities too easily exploitable, is unused and as a sanity
rule should not be used in the kernel to begin with.
Now, "printf(unfiltered_string);" is much less of a problem.
| -rw-r--r-- | sys/kern/subr_prf.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/sys/kern/subr_prf.c b/sys/kern/subr_prf.c index c9e8b91d530..da1d2c0dcbd 100644 --- a/sys/kern/subr_prf.c +++ b/sys/kern/subr_prf.c @@ -1,4 +1,4 @@ -/* $NetBSD: subr_prf.c,v 1.184 2020/05/23 23:42:43 ad Exp $ */ +/* $NetBSD: subr_prf.c,v 1.185 2020/07/11 07:14:53 maxv Exp $ */ /*- * Copyright (c) 1986, 1988, 1991, 1993 @@ -37,7 +37,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: subr_prf.c,v 1.184 2020/05/23 23:42:43 ad Exp $"); +__KERNEL_RCSID(0, "$NetBSD: subr_prf.c,v 1.185 2020/07/11 07:14:53 maxv Exp $"); #ifdef _KERNEL_OPT #include "opt_ddb.h" @@ -1373,20 +1373,21 @@ reswitch: switch (ch) { base = DEC; goto number; case 'n': + /* no %n support in the kernel, consume and skip */ if (flags & MAXINT) - *va_arg(ap, intmax_t *) = ret; + (void)va_arg(ap, intmax_t *); else if (flags & PTRINT) - *va_arg(ap, intptr_t *) = ret; + (void)va_arg(ap, intptr_t *); else if (flags & SIZEINT) - *va_arg(ap, ssize_t *) = ret; + (void)va_arg(ap, ssize_t *); else if (flags & QUADINT) - *va_arg(ap, quad_t *) = ret; + (void)va_arg(ap, quad_t *); else if (flags & LONGINT) - *va_arg(ap, long *) = ret; + (void)va_arg(ap, long *); else if (flags & SHORTINT) - *va_arg(ap, short *) = ret; + (void)va_arg(ap, short *); else - *va_arg(ap, int *) = ret; + (void)va_arg(ap, int *); continue; /* no output */ case 'O': flags |= LONGINT; |
