Re: [PATCH] isdnloop: NUL-terminate strings from userspace

[Dan Carpenter <dan.carpenter@oracle.com>]

On Mon, Mar 31, 2014 at 02:56:07PM +0200, Vegard Nossum wrote:
> Ping, Dave? Just making sure this doesn't fall through the cracks. I
> don't see the patch applied anywhere yet and without this patch we
> still have a valid security concern IMO.

Gar.  No...  To recap:

> On 7 March 2014 11:56, Vegard Nossum <vegard.nossum@oracle.com> wrote:
> > Both the in-kernel and BSD strlcpy() require that the source string is
> > NUL terminated.

The *whole point* of strlcpy() is that the source string doesn't have to
be NUL terminated.  The BSD man pages are trying to say that strlcpy()
only works on C-strings as opposed to Vstr or other safer string
implementions.

There is a potential problem in the kernel implementation of strlcpy()
because it does:

lib/string.c
   149  size_t strlcpy(char *dest, const char *src, size_t size)
   150  {
   151          size_t ret = strlen(src);
   152
   153          if (size) {
   154                  size_t len = (ret >= size) ? size - 1 : ret;
   155                  memcpy(dest, src, len);
   156                  dest[len] = '\0';
   157          }
   158          return ret;
   159  }

The strlen() on line 151 could read beyond the end of the source buffer
and if the memory wasn't mapped, it could Oops.

That concern doesn't apply here because the source string is on stack
memory and we will hit a NUL character before we hit unmapped memory.

regards,
dan carpenter