Skip to content

Commit f0a6b58

Browse files
azeemshaikh38kees
authored andcommitted
uml: Replace strlcpy with strscpy
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] KSPP#89 Signed-off-by: Azeem Shaikh <[email protected]> Signed-off-by: Kees Cook <[email protected]> Link: https://lore.kernel.org/r/[email protected]
1 parent a5a319e commit f0a6b58

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

arch/um/include/shared/user.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ static inline int printk(const char *fmt, ...)
5252
extern int in_aton(char *str);
5353
extern size_t strlcpy(char *, const char *, size_t);
5454
extern size_t strlcat(char *, const char *, size_t);
55+
extern size_t strscpy(char *, const char *, size_t);
5556

5657
/* Copied from linux/compiler-gcc.h since we can't include it directly */
5758
#define barrier() __asm__ __volatile__("": : :"memory")

arch/um/os-Linux/drivers/tuntap_user.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ static int tuntap_open(void *data)
146146
}
147147
memset(&ifr, 0, sizeof(ifr));
148148
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
149-
strlcpy(ifr.ifr_name, pri->dev_name, sizeof(ifr.ifr_name));
149+
strscpy(ifr.ifr_name, pri->dev_name, sizeof(ifr.ifr_name));
150150
if (ioctl(pri->fd, TUNSETIFF, &ifr) < 0) {
151151
err = -errno;
152152
printk(UM_KERN_ERR "TUNSETIFF failed, errno = %d\n",

0 commit comments

Comments
 (0)