[<prev] [next>] [day] [month] [year] [list]
Message-ID: <201907260928.23DE35406@keescook>
Date: Fri, 26 Jul 2019 09:31:03 -0700
From: Kees Cook <keescook@...omium.org>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: Joe Perches <joe@...ches.com>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Rasmus Villemoes <linux@...musvillemoes.dk>,
Yann Droneaud <ydroneaud@...eya.com>,
David Laight <David.Laight@...lab.com>,
Jonathan Corbet <corbet@....net>, Stephen Kitt <steve@....org>,
Nitin Gote <nitin.r.gote@...el.com>,
"jannh@...gle.com" <jannh@...gle.com>,
kernel-hardening@...ts.openwall.com, linux-kernel@...r.kernel.org
Subject: [PATCH] strscpy: reject buffer sizes larger than INT_MAX
As already done for snprintf(), add a check in strscpy() for giant
(i.e. likely negative and/or miscalculated) copy sizes, WARN, and
error out.
Signed-off-by: Kees Cook <keescook@...omium.org>
---
lib/string.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/string.c b/lib/string.c
index 461fb620f85f..913cb945a82a 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -182,7 +182,7 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
size_t max = count;
long res = 0;
- if (count == 0)
+ if (count == 0 || WARN_ON_ONCE(count > INT_MAX))
return -E2BIG;
#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
--
2.17.1
--
Kees Cook
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
