lkml.org 
[lkml]   [2023]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 6.1 33/34] apparmor: fix use of strcpy in policy_unpack_test
    Date
    From: Rae Moar <rmoar@google.com>

    [ Upstream commit b54aebd4411134b525a82d663a26b2f135ecb7e8 ]

    Replace the use of strcpy() in build_aa_ext_struct() in
    policy_unpack_test.c with strscpy().

    strscpy() is the safer method to use to ensure the buffer does not
    overflow. This was found by kernel test robot:
    https://lore.kernel.org/all/202301040348.NbfVsXO0-lkp@intel.com/.

    Reported-by: kernel test robot <lkp@intel.com>

    Signed-off-by: Rae Moar <rmoar@google.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/apparmor/policy_unpack_test.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c
    index 0a969b2e03dba..64ddea559f9ac 100644
    --- a/security/apparmor/policy_unpack_test.c
    +++ b/security/apparmor/policy_unpack_test.c
    @@ -66,31 +66,30 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,

    *buf = AA_NAME;
    *(buf + 1) = strlen(TEST_STRING_NAME) + 1;
    - strcpy(buf + 3, TEST_STRING_NAME);
    + strscpy(buf + 3, TEST_STRING_NAME, e->end - (void *)(buf + 3));

    buf = e->start + TEST_STRING_BUF_OFFSET;
    *buf = AA_STRING;
    *(buf + 1) = strlen(TEST_STRING_DATA) + 1;
    - strcpy(buf + 3, TEST_STRING_DATA);
    -
    + strscpy(buf + 3, TEST_STRING_DATA, e->end - (void *)(buf + 3));
    buf = e->start + TEST_NAMED_U32_BUF_OFFSET;
    *buf = AA_NAME;
    *(buf + 1) = strlen(TEST_U32_NAME) + 1;
    - strcpy(buf + 3, TEST_U32_NAME);
    + strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3));
    *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32;
    *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA;

    buf = e->start + TEST_NAMED_U64_BUF_OFFSET;
    *buf = AA_NAME;
    *(buf + 1) = strlen(TEST_U64_NAME) + 1;
    - strcpy(buf + 3, TEST_U64_NAME);
    + strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3));
    *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64;
    *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA;

    buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET;
    *buf = AA_NAME;
    *(buf + 1) = strlen(TEST_BLOB_NAME) + 1;
    - strcpy(buf + 3, TEST_BLOB_NAME);
    + strscpy(buf + 3, TEST_BLOB_NAME, e->end - (void *)(buf + 3));
    *(buf + 3 + strlen(TEST_BLOB_NAME) + 1) = AA_BLOB;
    *(buf + 3 + strlen(TEST_BLOB_NAME) + 2) = TEST_BLOB_DATA_SIZE;
    memcpy(buf + 3 + strlen(TEST_BLOB_NAME) + 6,
    @@ -99,7 +98,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
    buf = e->start + TEST_NAMED_ARRAY_BUF_OFFSET;
    *buf = AA_NAME;
    *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1;
    - strcpy(buf + 3, TEST_ARRAY_NAME);
    + strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3));
    *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY;
    *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE;

    --
    2.39.2
    \
     
     \ /
      Last update: 2023-07-24 03:45    [W:2.426 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site