[lkml]   [2014]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [patch 2/2] lib/string.c: strlcpy() might read too far
On Mon, Apr 14, 2014 at 02:46:15PM -0700, Andrew Morton wrote:
> On Wed, 2 Apr 2014 11:47:31 +0300 Dan Carpenter <> wrote:
> > Imagine you have a user controlled variable at the end of a struct which
> > is allocated at the end of a page. The strlen() could read beyond the
> > mapped memory and cause an oops.
> Well, it's hard to conceive of a situation where anything like this
> could happen. Code which copies a string from userspace should
> immediately ensure that the kernel copy is null-terminated. But... I
> guess it's defense in depth.

The code which prompted this is in isdnloop_start(). I did a:

- strcpy(card->s0num[0], sdef.num[0]);
+ strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));

So that we wouldn't corrupt memory. But the debate was whether that was
enough to solve the problem or it was better to null-terminate
sdef.num[0] before doing the strlcpy(). In the end, we decided to
reject input if it wasn't null terminated.

In this case sdef is declared on the stack so there lots NUL characters
so reading too far in the strlen() is not a problem.

dan carpenter

 \ /
  Last update: 2014-04-15 13:21    [W:0.045 / U:2.652 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site