Commit 2c41a0db authored by Samuel Thibault's avatar Samuel Thibault Committed by Zhang Xiaoxu
Browse files

speakup: Avoid crash on very long word 

mainline inclusion
from mainline-v6.9-rc5
commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5L5
CVE: CVE-2024-26994

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1



--------------------------------

In case a console is set up really large and contains a really long word
(> 256 characters), we have to stop before the length of the word buffer.

Signed-off-by: default avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
Fixes: c6e3fd22 ("Staging: add speakup to the staging directory")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240323164843.1426997-1-samuel.thibault@ens-lyon.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhang Xiaoxu <zhangxiaoxu5@huawei.com>
parent 3a4c6550

drivers/accessibility/speakup/main.c

+1 −1
Original line number Diff line number Diff line
@@ -576,7 +576,7 @@ static u_long get_word(struct vc_data *vc) 
	}

	attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr);

	buf[cnt++] = attr_ch;

	while (tmpx < vc->vc_cols - 1) {

	while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) {

		tmp_pos += 2;

		tmpx++;

		ch = get_char(vc, (u_short *)tmp_pos, &temp);