From: Alasdair G Kergon <agk@redhat.com>
To: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>,
Milan Broz <mbroz@redhat.com>,
Jaya Kumar <jayakumar.video@gmail.com>,
Laurent Pinchart <laurent.pinchart@skynet.be>,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Gene Sally <Gene.Sally@timesys.com>,
Sam Ravnborg <sam@ravnborg.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-next@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Subject: Re: strncat() misuse (was: Re: dm_attr_{name,uuid}_show buffer overflow? (was: Re: linux-next: Tree for January 5))
Date: Tue, 6 Jan 2009 01:27:59 +0000 [thread overview]
Message-ID: <20090106012759.GA3512@agk.fab.redhat.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0901052259420.5451@anakin>
On Mon, Jan 05, 2009 at 11:18:38PM +0100, Geert Uytterhoeven wrote:
> On Mon, 5 Jan 2009, Geert Uytterhoeven wrote:
> > On Mon, 5 Jan 2009, Stephen Rothwell wrote:
> > | strncat(buf, "\n", DM_NAME_LEN);
> > | return strnlen(buf, DM_NAME_LEN);
> > Probably the intention was to limit the string in _buf_ (not the source string
> > "\n") to DM_NAME_LEN? If yes, this may cause a buffer overflow.
Both the 'n's look bogus to me as runtime checks. But I think the code happens
to work correctly - apart from your compilation problem.
buf is always a page and both strings (name and uuid) are NULL-terminated and
the longest possible is 128 chars of uuid plus the "\n" i.e. 130 (except for a
bug I noticed on one code path which we'll fix).
Alasdair
--
agk@redhat.com
next prev parent reply other threads:[~2009-01-06 1:29 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-05 6:35 linux-next: Tree for January 5 Stephen Rothwell
2009-01-05 17:45 ` linux-next: Tree for January 5 (dm-target) Randy Dunlap
2009-01-06 3:45 ` Cheng Renquan
2009-01-05 20:04 ` linux-next: Tree for January 5 (multimedia build errors) Randy Dunlap
2009-01-06 11:35 ` Mauro Carvalho Chehab
2009-01-05 20:06 ` linux-next: Tree for January 5 (multimedia #2) Randy Dunlap
2009-01-06 11:39 ` Mauro Carvalho Chehab
2009-01-05 20:09 ` linux-next: Tree for January 5 (multimedia #3) Randy Dunlap
2009-01-07 0:36 ` Mauro Carvalho Chehab
2009-01-07 18:34 ` Randy Dunlap
2009-01-07 23:27 ` Mauro Carvalho Chehab
2009-01-07 23:36 ` Randy Dunlap
2009-01-05 20:11 ` [PATCH -next] jbd2: fix printk format warning Randy Dunlap
2009-01-11 18:52 ` Simon Holm Thøgersen
2009-01-11 19:07 ` Randy Dunlap
2009-01-11 19:20 ` Simon Holm Thøgersen
2009-01-05 21:41 ` dm_attr_{name,uuid}_show buffer overflow? (was: Re: linux-next: Tree for January 5) Geert Uytterhoeven
2009-01-05 22:18 ` strncat() misuse (was: Re: dm_attr_{name,uuid}_show buffer overflow? (was: Re: linux-next: Tree for January 5)) Geert Uytterhoeven
2009-01-05 22:18 ` Geert Uytterhoeven
2009-01-06 1:27 ` Alasdair G Kergon [this message]
2009-01-06 2:16 ` Alasdair G Kergon
2009-01-07 14:39 ` Laurent Pinchart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090106012759.GA3512@agk.fab.redhat.com \
--to=agk@redhat.com \
--cc=Gene.Sally@timesys.com \
--cc=akpm@linux-foundation.org \
--cc=geert@linux-m68k.org \
--cc=jayakumar.video@gmail.com \
--cc=laurent.pinchart@skynet.be \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=mbroz@redhat.com \
--cc=mchehab@infradead.org \
--cc=sam@ravnborg.org \
--cc=sfr@canb.auug.org.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.