netdev
[Top] [All Lists]

Re: [PATCH 2.6]: IPv6: strcpy -> strlcpy

To: "YOSHIFUJI Hideaki / ?$B5HF#1QL@?(B" <yoshfuji@xxxxxxxxxxxxxx>
Subject: Re: [PATCH 2.6]: IPv6: strcpy -> strlcpy
From: Russell King <rmk+lkml@xxxxxxxxxxxxxxxx>
Date: Thu, 27 Nov 2003 20:00:41 +0000
Cc: felipe_alfaro@xxxxxxxxxxxxx, davem@xxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxx
In-reply-to: <20031128.045413.133305490.yoshfuji@xxxxxxxxxxxxxx>; from yoshfuji@xxxxxxxxxxxxxx on Fri, Nov 28, 2003 at 04:54:13AM +0900
Mail-followup-to: "YOSHIFUJI Hideaki / ?$B5HF#1QL@?(B" <yoshfuji@xxxxxxxxxxxxxx>, felipe_alfaro@xxxxxxxxxxxxx, davem@xxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxx
References: <1069934643.2393.0.camel@xxxxxxxxxxxxxxxxxxxxxxxx> <20031127.210953.116254624.yoshfuji@xxxxxxxxxxxxxx> <20031127194602.A25015@xxxxxxxxxxxxxxxxxxxxxx> <20031128.045413.133305490.yoshfuji@xxxxxxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mutt/1.2.5.1i
On Fri, Nov 28, 2003 at 04:54:13AM +0900, YOSHIFUJI Hideaki / ?$B5HF#1QL@?(B 
wrote:
> In article <20031127194602.A25015@xxxxxxxxxxxxxxxxxxxxxx> (at Thu, 27 Nov 
> 2003 19:46:02 +0000), Russell King <rmk+lkml@xxxxxxxxxxxxxxxx> says:
> > I'm slightly cautious here, although I haven't read the patch yet.
> > Did anyone consider whether any of these structures were copied to
> > user space, and whether, as a result of this change, we're now
> > copying uninitialised data to users?
> 
> I believe that it, to change from strcpy() to strlcpy(), just 
> eliminates possibility of buffer-overrun.

While this is 100% correct, the bit which raised my attention was the
original message which didn't seem to show that the above had been
considered.

The thing that worries me is that an incorrect strlcpy() conversion
gives the impression that someone has thought about buffer underruns
as well as overruns, and, unless someone /has/ actually thought about
it, there could well still be a security problem lurking there.

I'm just overly wary of all strlcpy() conversions.

-- 
Russell King
 Linux kernel    2.6 ARM Linux   - http://www.arm.linux.org.uk/
 maintainer of:  2.6 PCMCIA      - http://pcmcia.arm.linux.org.uk/
                 2.6 Serial core

<Prev in Thread] Current Thread [Next in Thread>