[KJ] critical bug in strncpy()

[walter harms <wharms@bfs.de>]

[-- Attachment #1: Type: text/plain, Size: 1919 bytes --]

hi all,
The kernel version of strcpy() is buggy. it copies ALWAYS n bytes.
since i have NO idea if this is exploidable somehow, i would still
recomend to REMOVE the code. See example below if you do not believe me.
Also below you find a sniplet from libString/Strncpy.c.
i did not provide a patch since this is NOT my code. (btw: changed the 
name from Strncopy to strncpy). C&P this in to the kernel/lib/string.c.


re,
	walter


/* in case this is needed */
Signed-off-by: walter harms <wharms@bfs.de>



/* linux kernel */
char * K_strncpy(char * dest,const char *src,size_t count)
{
         char *tmp = dest;

         while (count) {
                 if ((*tmp = *src) != 0) src++;    <-MISSING  case == 0 

                 tmp++;
                 count--;
         }
         printf("count=%d\n",count);
         return dest;
}

int main()
{
char *src="15" ;
char dst[]="123";

K_strncpy(dst,src,500);

}


i looked a bit around and found these nice version.


/*
  * libString, Copyright (C) 1999 Patrick Alken
  * This library comes with absolutely NO WARRANTY
  *
  * Should you choose to use and/or modify this source code, please
  * do so under the terms of the GNU General Public License under which
  * this library is distributed.
  *
  * $Id: Strncpy.c,v 1.1.1.1 2000/10/02 12:02:27 decho Exp $
  */

#include <sys/types.h>

/*
Strncpy()
  Optimized version of strncpy().

Inputs: dest   - destination string
         source - source string
         bytes  - number of bytes to copy

NOTE: A terminating \0 character is only copied to 'dest' if
       'source' is terminated by one, provided the limit 'bytes'
       has not yet been reached.

Return: destination string
*/

char *
strncpy(char *dest, const char *source, const size_t bytes)

{
   register char *end = dest + bytes;
   register char *s = dest;

   while ((s < end) && (*s++ = *source++))
     ;

   return (dest);
} /* Strncpy() */



[-- Attachment #2: Type: text/plain, Size: 167 bytes --]

_______________________________________________
Kernel-janitors mailing list
Kernel-janitors@lists.osdl.org
http://lists.osdl.org/mailman/listinfo/kernel-janitors