On Fri, May 31, 2013 at 09:18:07AM -0700, Kees Cook wrote: > Fix various weird constructions of strncpy(dst, src, strlen(src)). Length > limits should be about the space available in the destination, not > repurposed as a method to either always include or always exclude > a trailing NULL byte. Either the NULL should always be copied > (using strlcpy), or it should not be copied (using something like > memcpy). Readable code should not depend on the weird behavior of strncpy > when it hits the length limit. Better to avoid the anti-pattern entirely. > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > --- > This is a follow-up to the anti-pattern being fixed in iscsi-target, > which was exploitable: > "iscsi-target: fix heap buffer overflow on error" > http://git.kernel.org/cgit/linux/kernel/git/nab/target-pending.git/commit/?id=cea4dcfdad926a27a18e188720efe0f2c9403456 > --- > Documentation/accounting/getdelays.c | 3 ++- > drivers/acpi/sysfs.c | 3 +-- > drivers/s390/net/qeth_l3_sys.c | 6 ++---- > drivers/staging/tidspbridge/rmgr/drv_interface.c | 3 +-- For the drivers/staging/ part of this: Acked-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
