linux-kernel - Re: [PATCH] doc: avoid strncpy in accounting tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 08 Jun 2013 13:50:06 -0500
From:	Rob Landley <rob@...dley.net>
To:	Kees Cook <keescook@...omium.org>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org
Subject: Re: [PATCH] doc: avoid strncpy in accounting tool

On 06/05/2013 09:49:30 PM, Kees Cook wrote:
> Avoid strncpy anti-pattern. Use strdup() instead, as already done for
> the logfile optarg.
> 
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
> Fix for -mm clean-up-scary-strncpydst-src-strlensrc-uses-fix.patch
> ---
>  Documentation/accounting/getdelays.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/Documentation/accounting/getdelays.c  
> b/Documentation/accounting/getdelays.c
> index f8ebcde..1db89d3 100644
> --- a/Documentation/accounting/getdelays.c
> +++ b/Documentation/accounting/getdelays.c
> @@ -272,7 +272,7 @@ int main(int argc, char *argv[])
>  	char *logfile = NULL;
>  	int loop = 0;
>  	int containerset = 0;
> -	char containerpath[1024];
> +	char *containerpath = NULL;
>  	int cfd = 0;
>  	int forking = 0;
>  	sigset_t sigset;
> @@ -299,7 +299,7 @@ int main(int argc, char *argv[])
>  			break;
>  		case 'C':
>  			containerset = 1;
> -			strncpy(containerpath, optarg, strlen(optarg) +  
> 1);
> +			containerpath = strdup(optarg);

*boggle* That an elaborate way of doing a standard strcpy(), isn't it?

(Assuming free() being done by exit() is ok, and that somebody's going  
to be modifying this string so just keeping the pointer to optarg might  
make ps look weird...)

Acked-by: Rob Landley <rob@...dley.net>

if Andrew hasn't grabbed it already (I'm days behind on email) please  
send through trivial@...nel.org.

Rob--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/