Re: [PATCH] tools/wmi: dell-smbios-example: fix 1-byte stack overflow in find_token()

[Pali Rohár]

On Monday 19 October 2026 21:22:50 Haoran Wang wrote:
> diff --git a/tools/wmi/dell-smbios-example.c b/tools/wmi/dell-smbios-example.c
> index 1f3e7ab14..214071f6f 100644
> --- a/tools/wmi/dell-smbios-example.c
> +++ b/tools/wmi/dell-smbios-example.c
> @@ -52,8 +52,8 @@ static int run_wmi_smbios_cmd(struct dell_wmi_smbios_buffer *buffer)
>  
>  static int find_token(__u16 token, __u16 *location, __u16 *value)
>  {
> -	char location_sysfs[60];
> -	char value_sysfs[57];
> +	char location_sysfs[61];
> +	char value_sysfs[58];

Hello, from this change it is absolutely impossible to figure out if
there is OOB access or not. 61 and 58 are just magic numbers and if
somebody send another patch which changes it to 62 and 59, or 60 and 57,
I think that people could also accept it.

If buffers are bound to some input, what about using sizeof() operator
on the input buffers and demystify magic numbers behind?

E.g.: char location_sysfs[sizeof(token_sysfs) + sizeof("/XXXX_location")]

Also another way to prevent buffer overflows: Use snprintf() instead of
sprintf() which can easily detects those buffer overflows.

>  	char buf[4096];
>  	FILE *f;
>  	int ret;