leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

clean up scary strncpy(dst, src, strlen(src)) uses

Browse Source 
Fix various weird constructions of strncpy(dst, src, strlen(src)).

Length limits should be about the space available in the destination,
not repurposed as a method to either always include or always exclude a
trailing NULL byte.  Either the NULL should always be copied (using
strlcpy), or it should not be copied (using something like memcpy).
Readable code should not depend on the weird behavior of strncpy when it
hits the length limit.  Better to avoid the anti-pattern entirely.

[akpm@linux-foundation.org: revert getdelays.c part due to missing bsd/string.h]
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	[staging]
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>	[acpi]
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Ursula Braun <ursula.braun@de.ibm.com>
Cc: Frank Blaschka <blaschka@linux.vnet.ibm.com>
Cc: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Kees Cook 2013-07-03 15:04:55 -07:00 committed by Linus Torvalds
parent e7152b97f3
commit 096a8aac6b
4 changed files with 10 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/acpi/sysfs.c
View File

@ -677,10 +677,9 @@ void acpi_irq_stats_init(void)
else else
sprintf(buffer, "bug%02X", i); sprintf(buffer, "bug%02X", i);
name = kzalloc(strlen(buffer) + 1, GFP_KERNEL); name = kstrdup(buffer, GFP_KERNEL);
if (name == NULL) if (name == NULL)
goto fail; goto fail;
strncpy(name, buffer, strlen(buffer) + 1);
sysfs_attr_init(&counter_attrs[i].attr); sysfs_attr_init(&counter_attrs[i].attr);
counter_attrs[i].attr.name = name; counter_attrs[i].attr.name = name;

6
drivers/s390/net/qeth_l3_sys.c
View File

@ -315,10 +315,8 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev,
if (qeth_configure_cq(card, QETH_CQ_ENABLED)) if (qeth_configure_cq(card, QETH_CQ_ENABLED))
return -EPERM; return -EPERM;
for (i = 0; i < 8; i++) snprintf(card->options.hsuid, sizeof(card->options.hsuid),
card->options.hsuid[i] = ' '; "%-8s", tmp);
card->options.hsuid[8] = '\0';
strncpy(card->options.hsuid, tmp, strlen(tmp));
ASCEBC(card->options.hsuid, 8); ASCEBC(card->options.hsuid, 8);
if (card->dev) if (card->dev)
memcpy(card->dev->perm_addr, card->options.hsuid, 9); memcpy(card->dev->perm_addr, card->options.hsuid, 9);

3
drivers/staging/tidspbridge/rmgr/drv_interface.c
View File

@ -421,12 +421,11 @@ static int omap3_bridge_startup(struct platform_device *pdev)
drv_datap->tc_wordswapon = tc_wordswapon; drv_datap->tc_wordswapon = tc_wordswapon;
if (base_img) { if (base_img) {
drv_datap->base_img = kmalloc(strlen(base_img) + 1, GFP_KERNEL); drv_datap->base_img = kstrdup(base_img, GFP_KERNEL);
if (!drv_datap->base_img) { if (!drv_datap->base_img) {
err = -ENOMEM; err = -ENOMEM;
goto err2; goto err2;
} }
strncpy(drv_datap->base_img, base_img, strlen(base_img) + 1);
} }
dev_set_drvdata(bridge, drv_datap); dev_set_drvdata(bridge, drv_datap);

11
fs/hppfs/hppfs.c
View File

@ -69,7 +69,7 @@ static char *dentry_name(struct dentry *dentry, int extra)
struct dentry *parent; struct dentry *parent;
char *root, *name; char *root, *name;
const char *seg_name; const char *seg_name;
int len, seg_len; int len, seg_len, root_len;
len = 0; len = 0;
parent = dentry; parent = dentry;
@ -81,7 +81,8 @@ static char *dentry_name(struct dentry *dentry, int extra)
} }
root = "proc"; root = "proc";
len += strlen(root); root_len = strlen(root);
len += root_len;
name = kmalloc(len + extra + 1, GFP_KERNEL); name = kmalloc(len + extra + 1, GFP_KERNEL);
if (name == NULL) if (name == NULL)
return NULL; return NULL;
@ -91,7 +92,7 @@ static char *dentry_name(struct dentry *dentry, int extra)
while (parent->d_parent != parent) { while (parent->d_parent != parent) {
if (is_pid(parent)) { if (is_pid(parent)) {
seg_name = "pid"; seg_name = "pid";
seg_len = strlen("pid"); seg_len = strlen(seg_name);
} }
else { else {
seg_name = parent->d_name.name; seg_name = parent->d_name.name;
@ -100,10 +101,10 @@ static char *dentry_name(struct dentry *dentry, int extra)
len -= seg_len + 1; len -= seg_len + 1;
name[len] = '/'; name[len] = '/';
strncpy(&name[len + 1], seg_name, seg_len); memcpy(&name[len + 1], seg_name, seg_len);
parent = parent->d_parent; parent = parent->d_parent;
} }
strncpy(name, root, strlen(root)); memcpy(name, root, root_len);
return name; return name;
} }