Page MenuHomeFreeBSD

libkern: Avoid a one-byte OOB access in strndup()
ClosedPublic

Authored by markj on Dec 5 2025, 9:39 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Sep 20, 3:57 AM
Unknown Object (File)
Fri, Sep 11, 8:32 AM
Unknown Object (File)
Fri, Sep 11, 2:49 AM
Unknown Object (File)
Sat, Sep 5, 4:23 AM
Unknown Object (File)
Fri, Aug 28, 1:33 PM
Unknown Object (File)
Fri, Aug 28, 12:51 PM
Unknown Object (File)
Aug 22 2026, 3:26 PM
Unknown Object (File)
Aug 21 2026, 1:13 AM
Subscribers

Details

Summary

If the length of the string is maxlen, we would end up copying maxlen+1
bytes, which violates the contract of the function. The result is the
same since that extra byte is overwritten.

Reported by: Kevin Day <kevin@your.org>

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Dec 5 2025, 9:39 PM
This revision is now accepted and ready to land.Dec 5 2025, 9:41 PM
sys/libkern/strndup.c
43–44

It would be cleaner to stop adding 1 to len. There is only one use of 'strnlen + 1' value, in malloc. There, you can add 1 explicitly.

Then the code becomes similar (if not identical) to the libc version.

markj marked an inline comment as done.

Take kib's suggestion

This revision now requires review to proceed.Dec 5 2025, 10:06 PM
This revision is now accepted and ready to land.Dec 5 2025, 10:29 PM