Re: [PATCH] isdnloop: NUL-terminate strings from userspace

[Dan Carpenter <dan.carpenter@oracle.com>]

On Fri, Mar 07, 2014 at 01:44:17PM +0100, Vegard Nossum wrote:
> On 03/07/2014 12:52 PM, Dan Carpenter wrote:
> >On Fri, Mar 07, 2014 at 12:42:12PM +0100, Vegard Nossum wrote:
> >>On 03/07/2014 12:26 PM, Dan Carpenter wrote:
> >>>On Fri, Mar 07, 2014 at 11:56:04AM +0100, Vegard Nossum wrote:
> >>>>Both the in-kernel and BSD strlcpy() require that the source string is
> >>>>NUL terminated.
> >>>
> >>>No.  You're obviously wrong.  What on earth?
> >>
> >>Well, from lib/string.c:
> >>
> >>size_t strlcpy(char *dest, const char *src, size_t size)
> >>{
> >>         size_t ret = strlen(src);
> >>
> >
> >Ah...  So you mean that we could read far beyond the end of the string
> >and it would be a DoS because there would be 4 gigs of memory before we
> >hit a NUL character.  That won't happen in this case because the user
> >only controls a small buffer.  Normal memory is full of NUL chars.
> 
> Well, that's true, but what happens if you accidentally read from an
> unmapped page or an mmio page?

Interesting idea, but "sdef" is on the stack so that doesn't apply here
even though it might apply to other strlcpy() callers.

It might apply to other places.

regards,
dan carpenter