[PATCH] um: mconsole: validate notify socket path length
Pengpeng Hou <[email protected]>
| Newsgroups | gmane.linux.uml.devel,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
mconsole_notify() copies the notify socket path into sockaddr_un.sun_path with strcpy(). There is no local check that the supplied path fits in the fixed Unix-domain socket path buffer. Reject notify socket paths that do not fit in sun_path instead of copying them blindly. Signed-off-by: Pengpeng Hou <[email protected]> --- arch/um/drivers/mconsole_user.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c index a04cd13c6315..2c0d2984055c 100644 --- a/arch/um/drivers/mconsole_user.c +++ b/arch/um/drivers/mconsole_user.c @@ -198,8 +198,11 @@ int mconsole_notify(char *sock_name, int type, const void *data, int len) if (err) return err; + memset(&target, 0, sizeof(target)); target.sun_family = AF_UNIX; - strcpy(target.sun_path, sock_name); + if (snprintf(target.sun_path, sizeof(target.sun_path), "%s", sock_name) >= + sizeof(target.sun_path)) + return -EINVAL; packet.magic = MCONSOLE_MAGIC; packet.version = MCONSOLE_VERSION; -- 2.50.1 (Apple Git-155)