kmodloader: fix out-of-bound access when parsing .modinfo

[project/ubox.git] / kmodloader.c

diff --git a/kmodloader.c b/kmodloader.c
index 5ba75c1..c780379 100644 (file)
--- a/kmodloader.c
+++ b/kmodloader.c
@@ -27,7 +27,6 @@
 #include <string.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <fcntl.h>

-#include <syslog.h>

 #include <libgen.h>
 #include <glob.h>
 #include <elf.h>
 #include <libgen.h>
 #include <glob.h>
 #include <elf.h>


@@ -303,12 +302,14 @@ static struct module* get_module_info(const char *module, const char *name)
        }
 
        strings = map + offset;
        }
 
        strings = map + offset;

-       while (strings && (strings < map + offset + size)) {
+       while (true) {

                char *sep;
                int len;
 
                while (!strings[0])
                        strings++;
                char *sep;
                int len;
 
                while (!strings[0])
                        strings++;

+               if (strings >= map + offset + size)
+                       break;

                sep = strstr(strings, "=");
                if (!sep)
                        break;
                sep = strstr(strings, "=");
                if (!sep)
                        break;


@@ -411,12 +412,14 @@ static int print_modinfo(char *module)
 
        strings = map + offset;
        printf("module:\t\t%s\n", module);
 
        strings = map + offset;
        printf("module:\t\t%s\n", module);

-       while (strings && (strings < map + offset + size)) {
+       while (true) {

                char *dup = NULL;
                char *sep;
 
                while (!strings[0])
                        strings++;
                char *dup = NULL;
                char *sep;
 
                while (!strings[0])
                        strings++;

+               if (strings >= map + offset + size)
+                       break;

                sep = strstr(strings, "=");
                if (!sep)
                        break;
                sep = strstr(strings, "=");
                if (!sep)
                        break;


@@ -610,7 +613,7 @@ static int main_insmod(int argc, char **argv)
        }
 
        if (init_module_folders()) {
        }
 
        if (init_module_folders()) {

-               fprintf(stderr, "falied to find the folder holding the modules\n");
+               fprintf(stderr, "Failed to find the folder holding the modules\n");

                return -1;
        }
 
                return -1;
        }
 


@@ -720,8 +723,15 @@ static int main_modprobe(int argc, char **argv)
 {
        struct module *m;
        char *name;
 {
        struct module *m;
        char *name;

+       char *mod = NULL;
+       int i;

 
 

-       if (argc != 2)
+       for (i = 1; i < argc; i++)
+               if (argv[i][0] != '-') {
+                       mod = argv[i];
+                       break;
+               }
+       if (!mod)

                return print_usage("modprobe");
 
        if (scan_loaded_modules())
                return print_usage("modprobe");
 
        if (scan_loaded_modules())


@@ -730,7 +740,7 @@ static int main_modprobe(int argc, char **argv)
        if (scan_module_folders())
                return -1;
 
        if (scan_module_folders())
                return -1;
 

-       name = get_module_name(argv[1]);
+       name = get_module_name(mod);

        m = find_module(name);
        if (m && m->state == LOADED) {
                ULOG_ERR("%s is already loaded\n", name);
        m = find_module(name);
        if (m && m->state == LOADED) {
                ULOG_ERR("%s is already loaded\n", name);


@@ -762,7 +772,7 @@ static int main_modprobe(int argc, char **argv)
 static int main_loader(int argc, char **argv)
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;
 static int main_loader(int argc, char **argv)
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;

-       char *dir = "/etc/modules.d/*";
+       char *dir = "/etc/modules.d/";

        struct module *m;
        glob_t gl;
        char *path;
        struct module *m;
        glob_t gl;
        char *path;


@@ -775,13 +785,17 @@ static int main_loader(int argc, char **argv)
        strcpy(path, dir);
        strcat(path, "*");
 
        strcpy(path, dir);
        strcat(path, "*");
 

-       if (scan_loaded_modules())
+       if (scan_loaded_modules()) {
+               free (path);

                return -1;
                return -1;

+       }

 
 

-       if (scan_module_folders())
+       if (scan_module_folders()) {
+               free (path);

                return -1;
                return -1;

+       }

 
 

-       syslog(LOG_INFO, "kmodloader: loading kernel modules from %s\n", path);
+       ULOG_INFO("loading kernel modules from %s\n", path);

 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                goto out;
 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                goto out;


@@ -832,6 +846,8 @@ static int main_loader(int argc, char **argv)
                avl_for_each_element(&modules, m, avl)
                        if ((m->state == PROBE) || (m->error))
                                ULOG_ERR("- %s - %d\n", m->name, deps_available(m, 1));
                avl_for_each_element(&modules, m, avl)
                        if ((m->state == PROBE) || (m->error))
                                ULOG_ERR("- %s - %d\n", m->name, deps_available(m, 1));

+       } else {
+               ULOG_INFO("done loading kernel modules from %s\n", path);

        }
 
 out:
        }
 
 out:


@@ -877,5 +893,6 @@ int main(int argc, char **argv)
        if (!strcmp(exec, "modprobe"))
                return main_modprobe(argc, argv);
 
        if (!strcmp(exec, "modprobe"))
                return main_modprobe(argc, argv);
 

+       ulog_open(ULOG_KMSG, LOG_USER, "kmodloader");

        return main_loader(argc, argv);
 }
        return main_loader(argc, argv);
 }