linux-kernel - Re: [PATCH] kconfig: nconf: NUL-terminate 'line' correctly in fill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <98b4d33c-24eb-4034-82ce-e88e85f8e6f2@gmail.com>
Date: Mon, 11 Aug 2025 14:51:16 +0200
From: Franco Martelli <martellif67@...il.com>
To: Thorsten Blum <thorsten.blum@...ux.dev>,
 Masahiro Yamada <masahiroy@...nel.org>, Randy Dunlap
 <rdunlap@...radead.org>, Nicolas Schier <nicolas.schier@...ux.dev>,
 Shankari Anand <shankari.ak0208@...il.com>,
 "nir.tzachar@...il.com" <nir.tzachar@...il.com>,
 Michal Marek <mmarek@...e.cz>
Cc: stable@...r.kernel.org, linux-kbuild@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kconfig: nconf: NUL-terminate 'line' correctly in
 fill_window()

On 10/08/25 at 16:22, Thorsten Blum wrote:
> Use 'min(len, x)' as the index instead of just 'len' to NUL-terminate
> the copied 'line' string at the correct position.
> 
> Add a newline after the local variable declarations to silence a
> checkpatch warning.
> 
> Cc: stable@...r.kernel.org
> Fixes: 692d97c380c6 ("kconfig: new configuration interface (nconfig)")
> Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
> ---
>   scripts/kconfig/nconf.gui.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
> index 7206437e784a..ec021ebd2c52 100644
> --- a/scripts/kconfig/nconf.gui.c
> +++ b/scripts/kconfig/nconf.gui.c
> @@ -175,8 +175,9 @@ void fill_window(WINDOW *win, const char *text)
>   	for (i = 0; i < total_lines; i++) {
>   		char tmp[x+10];
>   		const char *line = get_line(text, i);
> -		int len = get_line_length(line);
> -		strncpy(tmp, line, min(len, x));
> +		int len = min(get_line_length(line), x);
> +
> +		strncpy(tmp, line, len);
>   		tmp[len] = '\0';
>   		mvwprintw(win, i, 0, "%s", tmp);
>   	}

Is there a rationale behind the choice to avoid to use snprintf()
in these circumstance?
Preferring snprintf() you will not have to take care to
compute the position of the NULL terminating character of the
string, it's done automatically by this function.

Best regards,
-- 
Franco Martelli