Skip to contentSkip to conversation

Check maxlen on strnlen_user usage

PATCH New Ryan Mallon 1 participant 1 message Sep 1, 2011

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 Check maxlen on strnlen_user usage

strnlen_user returns the length of the string including the nul terminator. In the case where maxlen is reached strnlen_user returns maxlen + 1. Most callsites already check for this condition. Fix the call to strnlen_user in fs/exec.c to check for the maxlen case.

---

fs/exec.c +1 -1
index 25dcbe5..e19588c 100644
@@ -481,7 +481,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
 			goto out;
 
 		len = strnlen_user(str, MAX_ARG_STRLEN);
-		if (!len)
+		if (!len || len>  MAX_ARG_STRLEN)
 			goto out;
 
 		ret = -E2BIG;