DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2318

NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote on cards lacking a valid CISTPL_VERS_1

Summary

pccard_child_pnpinfo_str() passes sc->card.cis1_info[0] and [1] directly to pccard_safe_quote() with no NULL check. These pointers remain NULL when inserted card CIS omits CISTPL_VERS_1 or fails to emit null-terminated string before 0xff terminator. CIS parser sets NO error flag in that case so pccard_attach_card proceeds and creates child devices. pccard_safe_quote() dereferences *src unconditionally at :1001. Panics automatically when any driver attaches to such a child (via devadded -> bus_child_pnpinfo_str) and re-triggerable on demand by any unprivileged local user reading child pnpinfo sysctl. Every other consumer (pccard_set_default_descr:159 pccard_do_product_lookup:374 pccard_probe_nomatch:974 pccard_print_cis) guards against NULL; this one does not.

Discussion (0)

No comments yet.