small buffer overflow in ecryptfs_new_file_context()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Michael Halcrow,

The patch 237fead61998: "[PATCH] ecryptfs: fs/Makefile and
fs/Kconfig" from Oct 4, 2006, leads to the following static checker
warning:

	fs/ecryptfs/crypto.c:846 ecryptfs_new_file_context()
	error: off-by-one overflow 'crypt_stat->cipher' size 32.  rl = '0-32'

fs/ecryptfs/crypto.c
   841          cipher_name_len =
   842                  strlen(mount_crypt_stat->global_default_cipher_name);
   843          memcpy(crypt_stat->cipher,
   844                 mount_crypt_stat->global_default_cipher_name,
   845                 cipher_name_len);
   846          crypt_stat->cipher[cipher_name_len] = '\0';

We're basically doing a complicated:

	strcpy(crypt_stat->cipher,
	       mount_crypt_stat->global_default_cipher_name);

But ->global_default_cipher_name has one more character than ->cipher so
it doesn't necessarily fit.

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe ecryptfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Crypto]     [Device Mapper Crypto]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux