lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <869f4059-1fce-49e3-9edf-8bfa42aba4a6@kadam.mountain>
Date:   Fri, 6 Oct 2023 09:49:14 +0300
From:   Dan Carpenter <dan.carpenter@...aro.org>
To:     Ricardo Lopes <ricardoapl.dev@...il.com>
Cc:     manishc@...vell.com, GR-Linux-NIC-Dev@...vell.com,
        coiby.xu@...il.com, gregkh@...uxfoundation.org,
        netdev@...r.kernel.org, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: qlge: Replace strncpy with strscpy

On Fri, Oct 06, 2023 at 09:42:41AM +0300, Dan Carpenter wrote:
> On Thu, Oct 05, 2023 at 08:14:55PM +0100, Ricardo Lopes wrote:
> > Avoid read overflows and other misbehavior due to missing termination.
> > 
> 
> There aren't any read overflows in the current code.
> 

So when you're reviewing these to look for read overflows, a string
literal isn't going to overflow.  So that makes the last two obvious.
But for the first one you have to review the caller qlge_gen_reg_dump()
and the last parameter passed to qlge_build_coredump_seg_header() is
always a string literal so that's obvious too.

It's not really that much work to check for this.

regards,
dan carpenter

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ