From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alan Jenkins <sourcejedi.lkml@googlemail.com>
Date: Sat, 05 Sep 2009 18:17:52 +0000
Subject: Re: [PATCH] fix buffer overflow in udev_util_replace_whitespace()
Message-Id: <9b2b86520909051117m2c4963aeke023def78cdc99a7@mail.gmail.com>
List-Id: <linux-hotplug.vger.kernel.org>
References: <20090831173335.GL4363@florz.florz.dyndns.org>
In-Reply-To: <20090831173335.GL4363@florz.florz.dyndns.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: linux-hotplug@vger.kernel.org

On 9/5/09, Florian Zumbiehl <florz@florz.de> wrote:
> Hi,
>
> [...]
>> after
>>
>> strnlen("a", 2-1) = 0
>
> | $ cat foo.c
> |
> | #include <string.h>
> | #include <stdio.h>
> |
> | int main(){
> | 	printf("%u\n",strnlen("a",2-1));
> | 	return 0;
> | }
> |
> | $ gcc -o foo foo.c
> | $ ./foo
> | 1
> | $
>
> Florian

Indeed, excuse my brainfart.  Looking at the rest of the function I
agree it needs fixing,  Unless Andrey can correct us.

I'm not quite sure about this fix.  String functions normally do
something reasonable when a length of 0 is passed.  It looks like this
fixed version implements "length 0 is a special value meaning no
limit" :-) due to arithmetic underflow.

Oh - and reading code this closely usually is boring.  Especially when
you're scanning, and don't necessarily have much idea of the bigger
picture.  Auditting edge-case stability is even less exciting than
auditting security.  So thanks for lending a fresh set of eyeballs for
a while!

Alan