Page MenuHomeFreeBSD

libkern: Avoid a one-byte OOB access in strndup()
ClosedPublic

Authored by markj on Fri, Dec 5, 9:39 PM.
Tags
None
Referenced Files
F139416919: D54093.diff
Thu, Dec 11, 8:31 PM
Unknown Object (File)
Wed, Dec 10, 7:57 PM
Unknown Object (File)
Sun, Dec 7, 7:59 AM
Unknown Object (File)
Sat, Dec 6, 11:09 PM
Unknown Object (File)
Sat, Dec 6, 10:48 PM
Unknown Object (File)
Sat, Dec 6, 9:12 PM
Subscribers

Details

Summary

If the length of the string is maxlen, we would end up copying maxlen+1
bytes, which violates the contract of the function. The result is the
same since that extra byte is overwritten.

Reported by: Kevin Day <kevin@your.org>

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Fri, Dec 5, 9:39 PM
This revision is now accepted and ready to land.Fri, Dec 5, 9:41 PM
sys/libkern/strndup.c
43–44

It would be cleaner to stop adding 1 to len. There is only one use of 'strnlen + 1' value, in malloc. There, you can add 1 explicitly.

Then the code becomes similar (if not identical) to the libc version.

markj marked an inline comment as done.

Take kib's suggestion

This revision now requires review to proceed.Fri, Dec 5, 10:06 PM
This revision is now accepted and ready to land.Fri, Dec 5, 10:29 PM