Thread (8 messages) 8 messages, 2 authors, 2021-06-22

[PATCH 2/2] libkmod-builtin: consider final NIL in name length check

STALE1929d

From: Yauheni Kaliuta <hidden>
Date: 2021-06-08 06:29:33
Subsystem: the rest · Maintainer: Linus Torvalds

There is potential buffer overrun in kmod_builtin_iter_get_modname()
for the name of length PATH_MAX. The required buffer size is
PATH_MAX, so `modname[len] = '\0'` with len == PATH_MAX will write
right beyond the buffer.

Check the length against PATH_MAX - 1.

Signed-off-by: Yauheni Kaliuta <redacted>
---
 libkmod/libkmod-builtin.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libkmod/libkmod-builtin.c b/libkmod/libkmod-builtin.c
index a002cb5ee2c6..3d4d77ab29b3 100644
--- a/libkmod/libkmod-builtin.c
+++ b/libkmod/libkmod-builtin.c
@@ -246,7 +246,7 @@ bool kmod_builtin_iter_get_modname(struct kmod_builtin_iter *iter,
 
 	len = dot - line;
 
-	if (len >= PATH_MAX) {
+	if (len >= PATH_MAX - 1) {
 		sv_errno = ENAMETOOLONG;
 		goto fail;
 	}
-- 
2.31.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help