⬢ DragonFlyBSD Kernel Audit
DF-4875 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
--- a/sys/dev/disk/nata/atapi-fd.c	2026-09-24 17:15:01.460690390 +0000
+++ b/sys/dev/disk/nata/atapi-fd.c	2026-09-24 17:15:35.016254103 +0000
@@ -443,14 +443,22 @@
     struct ata_channel *ch = device_get_softc(device_get_parent(dev));
     struct ata_device *atadev = device_get_softc(dev);
     struct afd_softc *fdp = device_get_ivars(dev);
-    char sizestring[16];
+    char sizestring[32];
 
+    /*
+     * mediasize is fully device-controlled (READ_CAPACITY / _16, and it
+     * can wrap 64-bit), so the printed value may have up to 14 digits
+     * ("%juMB" = 17 bytes incl NUL).  Use ksnprintf() so a hostile
+     * device can never overflow the stack buffer.  (DF-4875)
+     */
     if (fdp->mediasize > 1048576 * 5)
-	ksprintf(sizestring, "%juMB", fdp->mediasize / 1048576);
+	ksnprintf(sizestring, sizeof(sizestring), "%juMB",
+		  (uintmax_t)fdp->mediasize / 1048576);
     else if (fdp->mediasize)
-	ksprintf(sizestring, "%juKB", fdp->mediasize / 1024);
+	ksnprintf(sizestring, sizeof(sizestring), "%juKB",
+		  (uintmax_t)fdp->mediasize / 1024);
     else
-	strcpy(sizestring, "(no media)");
+	ksnprintf(sizestring, sizeof(sizestring), "(no media)");
  
     device_printf(dev, "%s <%.40s %.8s> at ata%d-%s %s\n",
 		  sizestring, atadev->param.model, atadev->param.revision,