lkml.org 
[lkml]   [2018]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 05/18] iio: change strncpy+truncation to strlcpy
    On Mon, 16 Jul 2018 13:42:06 +0200
    Dominique Martinet <asmadeus@codewreck.org> wrote:

    > Jonathan Cameron wrote on Sun, Jul 15, 2018:
    > > On Fri, 13 Jul 2018 03:25:34 +0200
    > > Dominique Martinet <asmadeus@codewreck.org> wrote:
    > > > Generated by scripts/coccinelle/misc/strncpy_truncation.cocci
    > > >
    > > > Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
    > >
    > > Applied to the togreg branch of iio.git and pushed out as testing
    > > for the autobuilders to play with it.
    >
    > Thanks!
    >
    > I have been pointed out that strlcpy, unlike strncpy, will read past the
    > size given in the input string and thus is Bad™ if the input string is
    > not nul terminated.
    >
    > After taking the time to check I believe this should not happen as the
    > original name seems to come from a dentry's d_name after proper
    > preparation (a buffer is allocated precisely for this purpose), but it
    > will not hurt to wait for that version.
    >
    >
    > The second reason I was waiting is that I intended to check for each
    > patch if it is safe to not pad the end of the string with zeroes (to
    > avoid e.g. information leaks) and that seems OK as well here after a
    > quick check but I wouldn't trust my own eyes this late so I'll let you
    > be judge of that if you feel like taking v1 anyway.
    >
    > Otherwise, I'll recheck properly and submit a v2 with strscpy and a
    > better commit message after the coccinelle script is taken for inclusion
    > and doing a better check but this might take a while longer.
    >
    >
    > Thanks,

    In this particular case I'm fairly sure it is safe so I'll leave it as is.

    Thanks,

    Jonathan

    \
     
     \ /
      Last update: 2018-07-22 10:14    [W:3.408 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site