Re: [PATCH] symlink name and possible overflow in create_node()

[Johannes Erdfelt <johannes@erdfelt.com>]

On Tue, Feb 17, 2004, Olaf Hering <olh@suse.de> wrote:
> the filename array might overflow if I interpret the strncat man page correctly.
> 
> --- ./udev-add.c~       2004-02-16 22:58:24.000000000 +0100
> +++ ./udev-add.c        2004-02-17 19:56:56.000000000 +0100
> @@ -146,7 +146,7 @@ static int create_node(struct udevice *d
>         int tail;
> 
>         strncpy(filename, udev_root, sizeof(filename));
> -       strncat(filename, dev->name, sizeof(filename));
> +       strncat(filename, dev->name, sizeof(filename) - strlen(filename));
> 
>         switch (dev->type) {
>         case 'b':

strncpy/strncat don't null terminate strings if it hits the maximum
size. Looks like all of those calls need some code explicitly null
terminate the strings as well.

	strncpy(filename, udev_root, sizeof(filename));
	filename[sizeof(filename) - 1] = 0;
	strncat(filename, dev->name, sizeof(filename) - strlen(filename));
	filename[sizeof(filename) - 1] = 0;

Otherwise, it could cause strange behaviour when the strings are
actually used.

JE



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel