lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 363/849] fortify: Fix dropped strcpy() compile-time write overflow check
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit 072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb ]

    The implementation for intra-object overflow in str*-family functions
    accidentally dropped compile-time write overflow checking in strcpy(),
    leaving it entirely to run-time. Add back the intended check.

    Fixes: 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions")
    Cc: Daniel Axtens <dja@axtens.net>
    Cc: Francis Laniel <laniel_francis@privacyrequired.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/fortify-string.h | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
    index c1be37437e778..0c70febd03e95 100644
    --- a/include/linux/fortify-string.h
    +++ b/include/linux/fortify-string.h
    @@ -280,7 +280,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q)
    if (p_size == (size_t)-1 && q_size == (size_t)-1)
    return __underlying_strcpy(p, q);
    size = strlen(q) + 1;
    - /* test here to use the more stringent object size */
    + /* Compile-time check for const size overflow. */
    + if (__builtin_constant_p(size) && p_size < size)
    + __write_overflow();
    + /* Run-time check for dynamic size overflow. */
    if (p_size < size)
    fortify_panic(__func__);
    memcpy(p, q, size);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-15 23:53    [W:4.020 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site