lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 15 Dec 2020 06:10:05 +0000
From:   Al Viro <>
To:     Siddhesh Poyarekar <>
        Florian Weimer <>
Subject: Re: [PATCH] proc: Escape more characters in /proc/mounts output

On Tue, Dec 15, 2020 at 09:54:54AM +0530, Siddhesh Poyarekar wrote:

> +	get_user(byte, (const char __user *)data);
> +
> +	return byte ? strndup_user(data, PATH_MAX) : NULL;
>  }

No.  Not to mention anything else, you
	* fetch the same data twice
	* fail to check the get_user() results

Powered by blists - more mailing lists