Re: [PATCH v3] exec: load_script: Do not exec truncated interpreter path

Kees Cook
2019-02-15T17:01:43Z

On Fri, Feb 15, 2019 at 8:39 AM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Fri, Feb 15, 2019 at 8:18 AM Oleg Nesterov <oleg@redhat.com> wrote:
> >
> > Not sure. Consider a script file which has a single line
> >
> > #!/path/to/interpreter
> >
> > WITHOUT '\n' at the end.
>
> Heh. I'm not sure how valid that is, but it's an interesting case for sure.
>
> But it's actually fairly easy to fix with the franken-approach I did
> that combines mine and Kees' patches.
>
> Does this work?

+static inline bool no_tab_or_space(const char *first, const char *last)
+{
+ // Skip leading space
+ for (;tabspc(*first) ; first++)
+ if (!*first || first == last)
+ return false; // only space

The !*first will never hit here (since it's been checked to be either
' ' or '\t', and if first == last it's whitespace all the way, so we
could just return true here to bail out early (there's no interpreter
at all, so we want to -ENOEXEC still).

I'll get a version written and tested...

-Kees

--
Kees Cook