Skip to content

Commit b54aebd

Browse files
rmr167jrjohansen
authored andcommitted
apparmor: fix use of strcpy in policy_unpack_test
Replace the use of strcpy() in build_aa_ext_struct() in policy_unpack_test.c with strscpy(). strscpy() is the safer method to use to ensure the buffer does not overflow. This was found by kernel test robot: https://lore.kernel.org/all/[email protected]/. Reported-by: kernel test robot <[email protected]> Signed-off-by: Rae Moar <[email protected]> Signed-off-by: John Johansen <[email protected]>
1 parent 76862af commit b54aebd

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

security/apparmor/policy_unpack_test.c

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -69,31 +69,30 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
6969

7070
*buf = AA_NAME;
7171
*(buf + 1) = strlen(TEST_STRING_NAME) + 1;
72-
strcpy(buf + 3, TEST_STRING_NAME);
72+
strscpy(buf + 3, TEST_STRING_NAME, e->end - (void *)(buf + 3));
7373

7474
buf = e->start + TEST_STRING_BUF_OFFSET;
7575
*buf = AA_STRING;
7676
*(buf + 1) = strlen(TEST_STRING_DATA) + 1;
77-
strcpy(buf + 3, TEST_STRING_DATA);
78-
77+
strscpy(buf + 3, TEST_STRING_DATA, e->end - (void *)(buf + 3));
7978
buf = e->start + TEST_NAMED_U32_BUF_OFFSET;
8079
*buf = AA_NAME;
8180
*(buf + 1) = strlen(TEST_U32_NAME) + 1;
82-
strcpy(buf + 3, TEST_U32_NAME);
81+
strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3));
8382
*(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32;
8483
*((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA;
8584

8685
buf = e->start + TEST_NAMED_U64_BUF_OFFSET;
8786
*buf = AA_NAME;
8887
*(buf + 1) = strlen(TEST_U64_NAME) + 1;
89-
strcpy(buf + 3, TEST_U64_NAME);
88+
strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3));
9089
*(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64;
9190
*((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA;
9291

9392
buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET;
9493
*buf = AA_NAME;
9594
*(buf + 1) = strlen(TEST_BLOB_NAME) + 1;
96-
strcpy(buf + 3, TEST_BLOB_NAME);
95+
strscpy(buf + 3, TEST_BLOB_NAME, e->end - (void *)(buf + 3));
9796
*(buf + 3 + strlen(TEST_BLOB_NAME) + 1) = AA_BLOB;
9897
*(buf + 3 + strlen(TEST_BLOB_NAME) + 2) = TEST_BLOB_DATA_SIZE;
9998
memcpy(buf + 3 + strlen(TEST_BLOB_NAME) + 6,
@@ -102,7 +101,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
102101
buf = e->start + TEST_NAMED_ARRAY_BUF_OFFSET;
103102
*buf = AA_NAME;
104103
*(buf + 1) = strlen(TEST_ARRAY_NAME) + 1;
105-
strcpy(buf + 3, TEST_ARRAY_NAME);
104+
strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3));
106105
*(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY;
107106
*((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE;
108107

0 commit comments

Comments
 (0)