Re: [PATCH v6 01/10] of: fix out-of-bounds read in of_alias_scan() stem parser
Geert Uytterhoeven <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-devicetree,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <CAMuHMdVkF6TCcxpPQnhFT9697eKA_jGRDSOATst0GGVajnzxQw@mail.gmail.com> |
On Wed, 5 Aug 2026 at 22:31, Abdurrahman Hussain <[email protected]> wrote: > The stem parser tests isdigit(*(end - 1)) before checking end > start > and so reads one byte before the property name when the name is empty > or all digits. Check the bound first. > > Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id") > Cc: [email protected] > Assisted-by: Claude:claude-fable-5 [Claude Code] > Signed-off-by: Abdurrahman Hussain <[email protected]> Reviewed-by: Geert Uytterhoeven <[email protected]> Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected] In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds