From: Kees Cook <keescook@xxxxxxxxxxxx> Subject: strscpy: reject buffer sizes larger than INT_MAX As already done for snprintf(), add a check in strscpy() for giant (i.e. likely negative and/or miscalculated) copy sizes, WARN, and error out. Link: http://lkml.kernel.org/r/201907260928.23DE35406@keescook Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> Cc: Joe Perches <joe@xxxxxxxxxxx> Cc: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx> Cc: Yann Droneaud <ydroneaud@xxxxxxxxxx> Cc: David Laight <David.Laight@xxxxxxxxxx> Cc: Jonathan Corbet <corbet@xxxxxxx> Cc: Stephen Kitt <steve@xxxxxxx> Cc: Jann Horn <jannh@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- lib/string.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/lib/string.c~strscpy-reject-buffer-sizes-larger-than-int_max +++ a/lib/string.c @@ -183,7 +183,7 @@ ssize_t strscpy(char *dest, const char * size_t max = count; long res = 0; - if (count == 0) + if (count == 0 || WARN_ON_ONCE(count > INT_MAX)) return -E2BIG; #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS _
