From mboxrd@z Thu Jan  1 00:00:00 1970
From: Andrey Borzenkov <arvidjaar@mail.ru>
Date: Sat, 05 Sep 2009 18:51:49 +0000
Subject: Re: [PATCH] fix buffer overflow in udev_util_replace_whitespace()
Message-Id: <200909052251.52880.arvidjaar@mail.ru>
MIME-Version: 1
Content-Type: multipart/mixed; boundary="nextPart8134542.1Rd39zi7l6"
List-Id: <linux-hotplug.vger.kernel.org>
References: <20090831173335.GL4363@florz.florz.dyndns.org>
In-Reply-To: <20090831173335.GL4363@florz.florz.dyndns.org>
To: linux-hotplug@vger.kernel.org

--nextPart8134542.1Rd39zi7l6
Content-Type: Text/Plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

On Saturday 05 of September 2009 22:17:52 Alan Jenkins wrote:
> On 9/5/09, Florian Zumbiehl <florz@florz.de> wrote:
> > Hi,
> >
> > [...]
> >
> >> after
> >>
> >> strnlen("a", 2-1) =3D 0
> >>
> > | $ cat foo.c
> > |
> > | #include <string.h>
> > | #include <stdio.h>
> > |
> > | int main(){
> > | 	printf("%u\n",strnlen("a",2-1));
> > | 	return 0;
> > | }
> > |
> > | $ gcc -o foo foo.c
> > | $ ./foo
> > | 1
> > | $
> >
> > Florian
>=20
> Indeed, excuse my brainfart.  Looking at the rest of the function I
> agree it needs fixing,  Unless Andrey can correct us.
>=20

This change breaks udev_util_replace_whitespace().

#include <stdio.h>
#include <stddef.h>

main()
{
        int len =3D 3, i, j;
        char *str =3D "a b";
        char to[10];

        len =3D strnlen(str, len - 1);
        while (len && isspace(str[len-1]))
                len--;

        j =3D i =3D 0;
        while (i < len) {
                /* substitute multiple whitespace with a single '_' */
                if (isspace(str[i])) {
                        while (isspace(str[i]))
                                i++;
                        to[j++] =3D '_';
                        }
                to[j++] =3D str[i++];
        }
        to[j] =3D '\0';

        printf("'%s'\n", to);
}

{pts/1}% gcc -O0 foo.c
{pts/1}% ./a.out
'a'

instead of expected a_b

What is exact problem with original code?=20

--nextPart8134542.1Rd39zi7l6
Content-Type: application/pgp-signature; name=signature.asc 
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEABECAAYFAkqis0UACgkQR6LMutpd94zAJgCeLxqIfnedq9Dl9VfntIVxPQWs
LngAnRI1eLTZQN+m0dVfRlJVpis17GAi
=K2lL
-----END PGP SIGNATURE-----

--nextPart8134542.1Rd39zi7l6--