* Linus Torvalds <[email protected]> wrote:
> > 2) strscpy() will copy garbage past NUL from source into destination. It
> > won't
> > fault but still, who knows what lies after string.
>
> Yes, that's probably worth fixing before we get actual users..
Hm, this is the spot:
c = *(unsigned long *)(src+res);
*(unsigned long *)(dest+res) = c;
if (has_zero(c, &data, &constants)) {
data = prep_zero_mask(c, data, &constants);
data = create_zero_mask(data);
return res + find_zero(data);
}
We could do something like:
c = *(unsigned long *)(src+res);
*(unsigned long *)(dest+res) = c;
if (has_zero(c, &data, &constants)) {
unsigned int zero_pos;
data = prep_zero_mask(c, data, &constants);
data = create_zero_mask(data);
zero_pos = find_zero(data);
res += zero_pos;
memset(dest+res, 0, sizeof(long)-zero_pos);
return res;
}
I.e. the extra memset() clears out the partial word (if any) after the NUL.
Completely untested.
Thanks,
Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
