kconfig: fix possible buffer overflow

Buffer 'new_argv' is accessed without bound check after accessing with bound check via 'new_argc' index. Fixes: e298f3b ("kconfig: add built-in function support") Co-developed-by: Ivanov Mikhail <[email protected]> Signed-off-by: Konstantin Meskhidze <[email protected]> Signed-off-by: Masahiro Yamada <[email protected]>
cloudflareresearch · Sep 5, 2023 · a3b7039 · a3b7039
1 parent feec5e1
commit a3b7039
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
@@ -396,6 +396,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
 
 		p++;
 	}
+
+	if (new_argc >= FUNCTION_MAX_ARGS)
+		pperror("too many function arguments");
 	new_argv[new_argc++] = prev;
 
 	/*