From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753172AbdCMMmd (ORCPT ); Mon, 13 Mar 2017 08:42:33 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:19280 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753081AbdCMMmK (ORCPT ); Mon, 13 Mar 2017 08:42:10 -0400 Date: Mon, 13 Mar 2017 15:41:44 +0300 From: Dan Carpenter To: simran singhal Cc: gregkh@linuxfoundation.org, devel@driverdev.osuosl.org, outreachy-kernel@googlegroups.com, arve@android.com, riandrews@android.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH] staging: android: Replace strcpy with strlcpy Message-ID: <20170313124144.GE4136@mwanda> References: <20170311204001.GA13301@singhal-Inspiron-5558> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170311204001.GA13301@singhal-Inspiron-5558> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Mar 12, 2017 at 02:10:01AM +0530, simran singhal wrote: > Replace strcpy with strlcpy as strcpy does not check for buffer > overflow. > This is found using Flawfinder. > > Signed-off-by: simran singhal > --- > drivers/staging/android/ashmem.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c > index 7cbad0d..eb2f4ef 100644 > --- a/drivers/staging/android/ashmem.c > +++ b/drivers/staging/android/ashmem.c > @@ -548,7 +548,8 @@ static int set_name(struct ashmem_area *asma, void __user *name) > if (unlikely(asma->file)) > ret = -EINVAL; > else > - strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name); > + strlcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name, > + sizeof(asma->name + ASHMEM_NAME_PREFIX_LEN)); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This isn't right. Also please do some analysis to see if it's a real bug or a false positive. It is a false positive in this case. regards, dan carpenter