linux-kernel - Re: [PATCH v4] execve.2: execve also returns E2BIG if a string is too long

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b99cd99fb6758ceb4cf3152c038fda761d597bb6.camel@surriel.com>
Date:   Wed, 11 Oct 2023 16:53:20 -0400
From:   Rik van Riel <riel@...riel.com>
To:     Alejandro Colomar <alx@...nel.org>
Cc:     linux-man@...r.kernel.org, kernel-team@...a.com,
        linux-kernel@...r.kernel.org,
        Matthew House <mattlloydhouse@...il.com>,
        Eric Biederman <ebiederm@...ssion.com>
Subject: Re: [PATCH v4] execve.2: execve also returns E2BIG if a string is
 too long

On Wed, 2023-10-11 at 22:14 +0200, Alejandro Colomar wrote:
> Hi Rik,
> 
> On Wed, Oct 11, 2023 at 12:53:30PM -0400, Rik van Riel wrote:
> > Sigh, once again I did a git commit --amend without the latest file
> > change being
> > included. The change below should be good. Working with both git
> > and hg gets me sometimes :/
> > ---8<---
> > 
> > The execve syscall returns -E2BIG in 3 cases:
> > - The total length of the command line arguments and environment is
> > too large.
> > - An argument or environment string is longer than MAX_ARG_STRLEN.
> 
> I'm still concerned by the wording of this sentence (and the next
> one).
> When I (and any user-space programmer, I think) read "string is
> longer
> than FOO", I read `strlen(string) > FOO`.  Since it's rather
> `strlen(string) >= FOO`, I think you should clarify.  How about this?
> 
> -  An argument or environment string is longer (including the null
> byte)
>    than MAX_ARG_STRLEN.

That works. Would you like me to re-send a v5, or do you
want to massage the changelog when you apply the patch?

I must admit I paid more attention to the wording in the
man page than the wording in the changelog :)

-- 
All Rights Reversed.