linux-kernel - Re: [PATCH] ia32: strncpy does not null terminate string

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 21 Jul 2009 11:27:29 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Roel Kluin <roel.kluin@...il.com>
CC:	mingo@...hat.com, LKML <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] ia32: strncpy does not null terminate string

Roel Kluin wrote:
> 
> diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
> index 085a8c3..b114f57 100644
> --- a/arch/x86/ia32/sys_ia32.c
> +++ b/arch/x86/ia32/sys_ia32.c
> @@ -687,7 +687,7 @@ long sys32_vm86_warning(void)
>  		compat_printk(KERN_INFO
>  			      "%s: vm86 mode not supported on 64 bit kernel\n",
>  			      me->comm);
> -		strncpy(lastcomm, me->comm, sizeof(lastcomm));
> +		strncpy(lastcomm, me->comm, sizeof(lastcomm) - 1);
>  	}
>  	return -ENOSYS;
>  }

I don't see any problem with the code as written.  It is of course
correct that strncpy() doesn't null-terminate (it null-pads, which is
somewhat inefficient, but has info leak advantages), *however*, the only
user (it's a local static variable) uses strncpy(), so that's fine.

It probably could be done cleaner, but there is no actual bug, so I
personally don't see any reason to change it just in the interest of
avoiding churn.

	-hpa

-- 
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel.  I don't speak on their behalf.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/