SECURITY - data leakage due to incorrect strncpy implementation

DISCUSSION Martin Schwidefsky 1 participant 1 message Jan 29, 2004 s390

lore

Share & tools

lore

Martin Schwidefsky

author

2004-01-29 08:58 UTC #0 lore raw

Hi Pete,

Quoted 4 lines

I do not undestand Alan's position, if he is for it or against it. Anyway, in case you want it, here's what I wrote for s390. I wrote some userland tests, it seems to check out. BUT I warn you, someone better check my assembly.

Learning to write inline assembly? Nice, but it has one small problem, the count in %r4 is not decremented for 0x00 byte. Try my little patch.

blue skies,
Martin.

arch/s390/lib/strncpy.S +7 -2

diff -urN linux-2.6.1/arch/s390/lib/strncpy.S linux-2.6.1-s390/arch/s390/lib/strncpy.S
@@ -23,8 +23,13 @@
 	LA      3,1(3)
         STC     0,0(1)
 	LA      1,1(1)
-        JZ      strncpy_exit   # ICM inserted a 0x00
+        JZ      strncpy_pad    # ICM inserted a 0x00
         BRCT    4,strncpy_loop # R4 -= 1, jump to strncpy_loop if >  0
 strncpy_exit:
         BR      14
-
+strncpy_clear:
+	STC	0,0(1)
+	LA	1,1(1)
+strncpy_pad:
+	BRCT	4,strncpy_clear
+	BR	14

arch/s390/lib/strncpy64.S +7 -2

diff -urN linux-2.6.1/arch/s390/lib/strncpy64.S linux-2.6.1-s390/arch/s390/lib/strncpy64.S
@@ -23,8 +23,13 @@
 	LA      3,1(3)
         STC     0,0(1)
 	LA      1,1(1)
-        JZ      strncpy_exit   # ICM inserted a 0x00
+        JZ      strncpy_pad    # ICM inserted a 0x00
         BRCTG   4,strncpy_loop # R4 -= 1, jump to strncpy_loop if > 0
 strncpy_exit:
         BR      14
-
+strncpy_clear:
+	STC	0,0(1)
+	LA	1,1(1)
+strncpy_pad:
+	BRCTG	4,strncpy_clear
+	BR	14