[PATCH v2 08/10] libmultipath: fix invalid memory access in is_token()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Martin Wilck <mwilck@xxxxxxxx>

memcmp() must always be passed memory areas that are valid for the
full length given by the size argument.

See e.g. https://trust-in-soft.com/blog/2015/12/21/memcmp-requires-pointers-to-fully-valid-buffers/

Fixes: 7d95fb6 ("libmultipath: config parser: fix corner case for double quotes")
Signed-off-by: Martin Wilck <mwilck@xxxxxxxx>
---
 libmultipath/parser.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libmultipath/parser.c b/libmultipath/parser.c
index 4f65ba1..3875174 100644
--- a/libmultipath/parser.c
+++ b/libmultipath/parser.c
@@ -194,7 +194,9 @@ snprint_keyword(char *buff, int len, char *fmt, struct keyword *kw,
 static const char quote_marker[] = { '\0', '"', '\0' };
 bool is_quote(const char* token)
 {
-	return !memcmp(token, quote_marker, sizeof(quote_marker));
+	return token[0] == quote_marker[0] &&
+		token[1] == quote_marker[1] &&
+		token[2] == quote_marker[2];
 }
 
 vector
-- 
2.28.0


--
dm-devel mailing list
dm-devel@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/dm-devel




[Index of Archives]     [DM Crypt]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Packaging]     [Fedora SELinux]     [Yosemite Discussion]     [KDE Users]     [Fedora Docs]

  Powered by Linux