From: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
To: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: Sound updating, security of strlcpy and a question on pci v unload
Date: Fri, 11 Jul 2003 21:04:53 +0200 (CEST) [thread overview]
Message-ID: <Pine.LNX.4.44.0307112100240.843-100000@artax.karlin.mff.cuni.cz> (raw)
In-Reply-To: <1057943137.20637.27.camel@dhcp22.swansea.linux.org.uk>
> I'm currently updating the prehistoric OSS audio code in 2.5 to include
> all the new 2.4 drivers and 2.4 work. While some of them overlap ALSA
> drivers others are not in ALSA yet either.
>
> Firstly someone turned half the kernel into using strlcpy. Every single
> change I looked at bar two in the sound layer introduced a security
> hole. It looks like whoever did it just fired up a perl macro without
> realising the strncpy properties matter for data copied to user space.
> Looks like the rest wants auditing
What's the difference there? strlcpy always creates null-terminated
string, strncpy doesn't. strncpy in kernel (unlike user strncpy) does not
pad the whole destination buffer with zeros (see comment and
implementation in lib/string.c), so I don't see any point why strncpy
should be more secure.
Mikulas
next prev parent reply other threads:[~2003-07-11 18:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-07-11 17:05 Sound updating, security of strlcpy and a question on pci v unload Alan Cox
2003-07-11 19:04 ` Mikulas Patocka [this message]
2003-07-11 21:45 ` SECURITY - data leakage due to incorrect strncpy implementation Alan Cox
2003-07-11 22:10 ` Alan Cox
2003-07-11 23:49 ` Paul Mackerras
2003-07-12 21:28 ` Horst von Brand
2003-07-13 8:02 ` Alan Cox
2003-07-11 22:44 ` Linus Torvalds
2003-07-11 22:50 ` Alan Cox
2004-01-29 3:11 ` Pete Zaitcev
2003-07-11 22:37 ` Sound updating, security of strlcpy and a question on pci v unload Mitchell Blank Jr
2003-07-12 0:08 ` Greg KH
2003-07-12 14:03 Albert Cahalan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44.0307112100240.843-100000@artax.karlin.mff.cuni.cz \
--to=mikulas@artax.karlin.mff.cuni.cz \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).