From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kay Sievers Date: Thu, 01 Feb 2007 19:26:17 +0000 Subject: Re: [PATCH 2/3] udev_rules_apply_format(): don't overflow the Message-Id: <1170357977.3893.44.camel@pim.off.vrfy.org> List-Id: References: <1170342384945-git-send-email-vsu@altlinux.ru> In-Reply-To: <1170342384945-git-send-email-vsu@altlinux.ru> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-hotplug@vger.kernel.org On Thu, 2007-02-01 at 22:09 +0300, Sergey Vlasov wrote: > On Thu, Feb 01, 2007 at 06:18:16PM +0100, Kay Sievers wrote: > > On 2/1/07, Sergey Vlasov wrote: > > >When truncating the substitution string to the length specified in the > > >format string, head[len] = '\0' could write outside the buffer if that > > >length was too large. > > > > > >Signed-off-by: Sergey Vlasov > > >--- > > > udev_rules.c | 2 +- > > > 1 files changed, 1 insertions(+), 1 deletions(-) > > > > > >diff --git a/udev_rules.c b/udev_rules.c > > >index 44b41e9..90a83e5 100644 > > >--- a/udev_rules.c > > >+++ b/udev_rules.c > > >@@ -558,7 +558,7 @@ found: > > > break; > > > } > > > /* possibly truncate to format-char specified length */ > > >- if (len != -1) { > > >+ if (len >= 0 && (size_t)len < maxsize - (head-string)) { > > > > Yeah, that should be fixed. Wouldn't: > > if (len >= 0 && len <= strlen(head)) > > also catch strings which fit in the buffer, but are shorter than the > > specified limit? > > Yes, this should work properly too (or even "&& len < strlen(head)" to > skip writing '\0' over itself). Working in constant time is probably > not an issue here, given the number of strlcat() calls around. I've applied this together with the other patch, which logs an error for unknown substitutions. Thanks a lot, Kay ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier. Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net Linux-hotplug-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel