linux-kernel - Re: [PATCH] isdnloop: NUL-terminate strings from userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140307130556.GN4774@mwanda>
Date:	Fri, 7 Mar 2014 16:05:56 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Vegard Nossum <vegard.nossum@...cle.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] isdnloop: NUL-terminate strings from userspace

On Fri, Mar 07, 2014 at 01:44:17PM +0100, Vegard Nossum wrote:
> On 03/07/2014 12:52 PM, Dan Carpenter wrote:
> >On Fri, Mar 07, 2014 at 12:42:12PM +0100, Vegard Nossum wrote:
> >>On 03/07/2014 12:26 PM, Dan Carpenter wrote:
> >>>On Fri, Mar 07, 2014 at 11:56:04AM +0100, Vegard Nossum wrote:
> >>>>Both the in-kernel and BSD strlcpy() require that the source string is
> >>>>NUL terminated.
> >>>
> >>>No.  You're obviously wrong.  What on earth?
> >>
> >>Well, from lib/string.c:
> >>
> >>size_t strlcpy(char *dest, const char *src, size_t size)
> >>{
> >>         size_t ret = strlen(src);
> >>
> >
> >Ah...  So you mean that we could read far beyond the end of the string
> >and it would be a DoS because there would be 4 gigs of memory before we
> >hit a NUL character.  That won't happen in this case because the user
> >only controls a small buffer.  Normal memory is full of NUL chars.
> 
> Well, that's true, but what happens if you accidentally read from an
> unmapped page or an mmio page?

Interesting idea, but "sdef" is on the stack so that doesn't apply here
even though it might apply to other strlcpy() callers.

It might apply to other places.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/