Files
linux/lib
Josh Law 8cdf30813e lib/ts_kmp: fix integer overflow in pattern length calculation
The ts_kmp algorithm stores its prefix_tbl[] table and pattern in a single
allocation sized from the pattern length.  If the prefix_tbl[] size
calculation wraps, the resulting allocation can be too small and
subsequent pattern copies can overflow it.

Fix this by rejecting zero-length patterns and by using overflow helpers
before calculating the combined allocation size.


This fixes a potential heap overflow.  The pattern length calculation can
wrap during a size_t addition, leading to an undersized allocation. 
Because the textsearch library is reachable from userspace via Netfilter's
xt_string module, this is a security risk that should be backported to LTS
kernels.

Link: https://lkml.kernel.org/r/20260308202028.2889285-2-objecting@objecting.org
Signed-off-by: Josh Law <objecting@objecting.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-03-27 21:19:44 -07:00
..
2025-03-16 22:30:49 -07:00
2025-04-11 17:32:37 -07:00
2021-08-19 09:02:55 +09:00
2023-02-02 22:50:01 -08:00
2023-02-02 22:50:01 -08:00
2021-01-03 20:05:18 -05:00
2021-08-19 09:02:55 +09:00
2025-10-24 21:39:27 +02:00
2024-10-14 16:33:24 -05:00
2026-01-11 06:09:11 -10:00
2025-11-27 14:24:30 -08:00
2021-07-08 11:48:20 -07:00
2024-02-15 12:17:28 -05:00
2021-06-18 11:43:09 +02:00
2025-03-25 10:18:31 -03:00
2024-12-09 13:48:29 -08:00
2025-09-13 16:54:46 -07:00