lkml.org 
[lkml]   [2009]   [Nov]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] strcmp: fix overflow and possibly signedness error
    Date
    From: Linus Torvalds <torvalds@linux-foundation.org>

    signed char __res = *cs - *ct;

    is wrong for two reasons. The subtraction can overflow because __res
    doesn't use a type big enough. Moreover the compared bytes should be
    interpreted as unsigned char as specified by POSIX.

    The same problem is fixed in strncmp.

    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Cc: Michael Buesch <mb@bu3sch.de>
    Cc: Andreas Schwab <schwab@linux-m68k.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    ---
    Hello Linus,

    I resend with a (hopefully) nice commit log as this didn't appear in
    your tree up to now.

    Best regards
    Uwe

    lib/string.c | 20 ++++++++++++++------
    1 files changed, 14 insertions(+), 6 deletions(-)

    diff --git a/lib/string.c b/lib/string.c
    index b19b87a..e96421a 100644
    --- a/lib/string.c
    +++ b/lib/string.c
    @@ -246,13 +246,17 @@ EXPORT_SYMBOL(strlcat);
    #undef strcmp
    int strcmp(const char *cs, const char *ct)
    {
    - signed char __res;
    + unsigned char c1, c2;

    while (1) {
    - if ((__res = *cs - *ct++) != 0 || !*cs++)
    + c1 = *cs++;
    + c2 = *ct++;
    + if (c1 != c2)
    + return c1 < c2 ? -1 : 1;
    + if (!c1)
    break;
    }
    - return __res;
    + return 0;
    }
    EXPORT_SYMBOL(strcmp);
    #endif
    @@ -266,14 +270,18 @@ EXPORT_SYMBOL(strcmp);
    */
    int strncmp(const char *cs, const char *ct, size_t count)
    {
    - signed char __res = 0;
    + unsigned char c1, c2;

    while (count) {
    - if ((__res = *cs - *ct++) != 0 || !*cs++)
    + c1 = *cs++;
    + c2 = *ct++;
    + if (c1 != c2)
    + return c1 < c2 ? -1 : 1;
    + if (!c1)
    break;
    count--;
    }
    - return __res;
    + return 0;
    }
    EXPORT_SYMBOL(strncmp);
    #endif
    --
    1.6.5.2
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-11-18 22:35    [W:0.051 / U:0.784 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site