Re: [patch 2/2] lib/string.c: strlcpy() might read too far

[Dave Jones <davej@redhat.com>]

On Wed, Apr 02, 2014 at 11:47:31AM +0300, Dan Carpenter wrote:
 > Imagine you have a user controlled variable at the end of a struct which
 > is allocated at the end of a page.  The strlen() could read beyond the
 > mapped memory and cause an oops.
 > 
 > Probably there are two reasons why we have never hit this condition in
 > real life.  First you would have to be really unlucky for all the
 > variables to line up so the oops can happen.  Second we don't do a lot
 > of fuzzing with invalid strings.

The latter isn't necessarily true, trinity does pass all kinds of
garbage, including malformed ascii of various lengths. But what it
doesn't do fully is pass pointers to this junk in every struct we have
in the kernel. (Just the ones it knows about, which for now is mostly
things like sockaddr_t).

Do you have an example struct with layout like you describe ?
It probably wouldn't be much work to teach the fuzzer about it.
(The tricky part is getting such a malformed struct past the validation
 various syscalls do).

	Dave