• Masahiro Yamada's avatar
    modpost: fix undefined behavior of is_arm_mapping_symbol() · d6b73266
    Masahiro Yamada authored
    The return value of is_arm_mapping_symbol() is unpredictable when "$"
    is passed in.
    
    strchr(3) says:
      The strchr() and strrchr() functions return a pointer to the matched
      character or NULL if the character is not found. The terminating null
      byte is considered part of the string, so that if c is specified as
      '\0', these functions return a pointer to the terminator.
    
    When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
    referenced (i.e. buffer overrun).
    
    Test code
    ---------
    
      char str1[] = "abc";
      char str2[] = "ab";
    
      strcpy(str1, "$");
      strcpy(str2, "$");
    
      printf("test1: %d\n", is_arm_mapping_symbol(str1));
      printf("test2: %d\n", is_arm_mapping_symbol(str2));
    
    Result
    ------
    
      test1: 0
      test2: 1
    Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
    Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
    d6b73266
modpost.c 68.2 KB