From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Kay Sievers" Date: Thu, 01 Feb 2007 17:18:16 +0000 Subject: Re: [PATCH 2/3] udev_rules_apply_format(): don't overflow the buffer Message-Id: <3ae72650702010918h1c008294scaecd68cf0259cb8@mail.gmail.com> List-Id: References: <1170342384945-git-send-email-vsu@altlinux.ru> In-Reply-To: <1170342384945-git-send-email-vsu@altlinux.ru> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-hotplug@vger.kernel.org On 2/1/07, Sergey Vlasov wrote: > When truncating the substitution string to the length specified in the > format string, head[len] = '\0' could write outside the buffer if that > length was too large. > > Signed-off-by: Sergey Vlasov > --- > udev_rules.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/udev_rules.c b/udev_rules.c > index 44b41e9..90a83e5 100644 > --- a/udev_rules.c > +++ b/udev_rules.c > @@ -558,7 +558,7 @@ found: > break; > } > /* possibly truncate to format-char specified length */ > - if (len != -1) { > + if (len >= 0 && (size_t)len < maxsize - (head-string)) { Yeah, that should be fixed. Wouldn't: if (len >= 0 && len <= strlen(head)) also catch strings which fit in the buffer, but are shorter than the specified limit? Thanks, Kay ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier. Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net Linux-hotplug-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel