Check maxlen on strnlen_user usage
Subsystems (2)
PATCH 1/1 Check maxlen on strnlen_user usage
strnlen_user returns the length of the string including the nul terminator. In the case where maxlen is reached strnlen_user returns maxlen + 1. Most callsites already check for this condition. Fix the call to strnlen_user in fs/exec.c to check for the maxlen case.
Signed-off-by Ryan Mallon <[email protected]>
---
fs/exec.c +1 -1
@@ -481,7 +481,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv, goto out; len =strnlen_user (str,MAX_ARG_STRLEN ); -if (!len) +if (!len || len>MAX_ARG_STRLEN ) goto out; ret = -E2BIG ;